Support Product Security

My Cloud OS 5 Firmware 5.27.157

WDC Tracking Number: WDC-23012
Published: October 23, 2023

Last Updated:  October 23, 2023

Description

My Cloud OS 5 Firmware 5.27.157 is a major security release containing updates to help improve the security of your My Cloud devices. Numerous changes were made to the operating system in order to comprehensively improve its security. The major user-visible security highlights of this release are listed below.

The base operating system has been upgraded from Debian 10 “Buster” to Debian 11 “Bullseye” to align with security and stability updates.

  • Updated OpenVPN to version 2.5.1-3
  • Updated mdadm to version 4.1-11
  • Updated Perl to version 5.32.1-4+deb11u2
  • Updated smartmontools to version 7.2-1
  • Updated SQLite3 to version 3.34.1-3
  • Updated util-linux to version 2.36.1-8+deb11u1
  • Updated Apache 2 to version 2.4.56-1~deb11u2
  • Updated BusyBox to version 1.30.1-6
  • Updated Pure-FTPd to version 1.0.49-4.1
  • Updated rsync to version 3.2.3-4+deb11u1
  • Updated rsyslog to version 8.2102.0-2+deb11u1
  • Updated sg3-utils to version 1.45-1
  • Updated wget to version 1.21-1+deb11u1
  • Updated MariaDB to version 10.5.19-0+deb11u2
  • Updated OpenSSH to version 8.4p1-5+deb11u1
  • Updated OpenSSL to version 1.1.1n-0+deb11u5 to resolve CVE-2022-2097, CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-2650 that could result in inadequate encryption, app crashes, use-after-free or denial of service attacks
  • Updated Curl to version 7.74.0-1.3+deb11u7 to resolve CVE-2021-22946, CVE-2022-27774, CVE-2022-32221, CVE-2022-43552, CVE-2023-23916 that could allow an attacker to expose possibly sensitive data in clear text over the network, obtain sensitive information or leak credentials, exploit use after free vulnerability or allocate resources without limits
  • Updated Avahi to version 0.8-5+deb11u2 to resolve CVE-2021-3468 that could allow a local attacker to trigger an infinite loop which may result in unavailability of Avahi service
  • Updated various other open-source packages to newer versions based on Debian 11 ("Bullseye")
  • Improved the security posture of the FTP Downloads application. Updated the application to version 1.15
Product Impact
Last Updated
My Cloud PR2100
October 18, 2023
My Cloud PR4100
October 18, 2023
My Cloud EX4100
October 18, 2023
My Cloud EX2 Ultra
October 18, 2023
My Cloud Mirror G2
October 18, 2023
My Cloud DL2100
October 18, 2023
My Cloud DL4100
October 18, 2023
My Cloud EX2100
October 18, 2023
My Cloud
October 18, 2023
WD Cloud
October 18, 2023

For more information on the latest security updates, see the release notes: https://os5releasenotes.mycloud.com/#/

Advisory Summary

Addressed a vulnerability in the Samba AD that can allow users to bypass certain restrictions associated with changing passwords.

CVE Number: CVE-2022-2031

Addressed a vulnerability in Samba where all version enabled with SMB1 were vulnerable to a server memory information leak bug over SMB1 if a client can write data to a share.

CVE Number: CVE-2022-32742

Addressed an encryption flaw in the Samba AD that could allow users to change other users’ passwords, enabling full domain takeover.

CVE Number: CVE-2022-32744

Addressed a use-after-free vulnerability in the Samba AD LDAP server that could result in a corrupted log output or crash.

CVE Number: CVE-2022-32746

Resolved an integer overflow vulnerability in Samba that affected PAC parsing in MIT Kerberos 5 that may lead to remote code execution on 32-bit platforms and cause a denial of service on other platforms.

CVE Number: CVE-2022-42898

Addressed an insufficiently protected credentials vulnerability that existed in Curl that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

CVE Number: CVE-2022-27774