Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
On October 04, 2024, Redis disclosed multiple vulnerabilities regarding the Redis In-Memory Database. As per the available information, the following are the vulnerability details:
| CVE ID | Vulnerability |
|---|---|
The most severe of these vulnerabilities is CVE-2024-31449, which is classified as a High severity and has a CVSS score of 8.8. It could allow remote attackers to execute arbitrary code on affected systems.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
Although the design of our database product did not allow the remote users to exploit the vulnerability, IONOS has rolled out the patched versions. As of now, there is no known exploit for these reported vulnerabilities.
IONOS Cloud has already rolled out the patched versions for the reported vulnerabilities.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
Allows an authenticated remote user to execute an arbitrary remote code.
The vulnerabilities allow a remote user to perform Denial of Service (DoS) attack.
Databases
Yes
Yes
Done
On September 26, 2024, a security researcher identified multiple vulnerabilities in the Linux Common Unix Printing System (CUPS). The following are the vulnerabilities found in OpenPinting CUPS:
| CVE ID | Vulnerability |
|---|---|
The most severe of these vulnerabilities is CVE-2024-47177, which is classified as a Critical severity and has a CVSS score of 9.0.
To exploit this vulnerability, the following conditions must be met:
1. The Linus CUPS-browsed service is manually enabled.
2. An attacker has access to a vulnerable server, which allows unrestricted access, such as to the public internet, or gains access to an internal network where the local connections are trusted.
3. The attacker advertises a malicious Internet Printing Protocol (IPP) server, providing a malicious printer.
4. A potential victim attempts to print from a malicious device.
5. An attacker executes arbitrary code on the victim’s machine.
Linux CUPS vulnerabilities do not impact any of the IONOS Cloud products.
This vulnerability does not impact IONOS Cloud products. Hence, no action is needed.
Users should review their use of Linux CUPS and, if enabled, follow the vendor-specific guidance to patch the environment.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
On November 20, 2024, the Kubernetes Security Response Committee disclosed a vulnerability that could allow a user with the ability to create a pod and associate a gitRepo volume to execute arbitrary commands beyond the container boundary.
The Kubernetes Security Response Committee assigned this vulnerability the CVE ID CVE-2024-10220 and classified it as High severity with a CVSS score of 8.1.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
Warning: To mitigate this issue, you must update your Managed Kubernetes instance to a non-vulnerable version. For more information, see What action can you take to mitigate the vulnerability?
IONOS Cloud infrastructure and services do not utilize the vulnerable versions of Managed Kubernetes, so they are not impacted.
If you use affected Managed Kubernetes versions, upgrading your clusters to one of the following fixed versions is recommended:
| Affected Versions | Fixed Versions |
|---|---|
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
A security researcher discovered a security issue in Kubernetes where an unauthorized user may be able to SSH to a node VM, which uses a VM image built with the Kubernetes project. The vulnerable images contain a pre-configured user with a weak default password, which can be accessed via SSH. The user can then use "sudo" to escalate privileges to root.
The following are the vulnerabilities found in Kubernetes Image Builder:
| CVE ID | Summary |
|---|
The most severe of these vulnerabilities is , which is classified as Critical severity with a CVSS score of 9.8.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|
The IONOS-provided managed Kubernetes environment is not based on Proxmox Image Builder, so CVE-2024-9486 does not impact our infrastructure and user environments. However, some parts of our infrastructure use QEMU to build clusters and are impacted by CVE-2024-9594. Even though CVE-2024-9594 is rated as medium, we consider this issue very low severity as we already have the required mitigation to prevent the mentioned attack vector on our infrastructure. At the moment, no active exploitation of these vulnerabilities is known.
IONOS Cloud will apply the patch to the affected products and services soon. We will update the patching status once the process is complete.
IONOS Cloud owns the patching responsibility, and no action is required from the user.
On October 18, 2024, Grafana Labs disclosed a vulnerability introduced in Grafana 11 that may allow attackers to execute arbitrary code on affected systems, potentially leading to complete system compromise.
This vulnerability is assigned the CVE ID and classified as Critical severity with a CVSS score of 9.9. For more information about the technical details of the vulnerability, refer to Grafana's .
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|
IONOS Cloud infrastructure and services do not utilize the vulnerable version of Grafana, so they are not impacted.
If you are using custom images, we advise you to refer to the information provided by the Operating System (OS) vendor to address any concerns from this reported issue.
If you have further questions or concerns about this vulnerability, contact .
The Vulnerability Register reports security vulnerabilities affecting IONOS Cloud products and services. The information provided is part of an ongoing effort to help you manage security risks and protect your systems.
| CVE ID | CVSS Base Score | Severity | Is Patch Available | Patch Deployed on and Status | Patch Responsibility |
|---|
Disclaimer: You will leave our site by clicking on external links. We do not have control over the content or availability of the linked websites, nor do we endorse or guarantee their accuracy, relevance, or completeness. We are not responsible for any issues from accessing or using these external websites, and we recommend reviewing the terms and privacy policies.
We highly recommend using the public vulnerability database as an invaluable resource for your security efforts. The NIST public vulnerability database provides comprehensive information on known vulnerabilities, including detailed descriptions, severity ratings, and mitigation strategies.
For third-party dependant assets and services provided by IONOS Cloud, we recommend that you closely monitor the below external resources for the latest security-related information.
To stay informed about the latest security vulnerabilities affecting various software, operating systems, and network components, regularly monitoring and referencing the above resources are crucial. By doing so, you can proactively assess and address potential security risks within your infrastructure.
If you have further questions or concerns about this vulnerability, contact .
| Product | Asset | Vulnerability Register |
|---|
By chaining these vulnerabilities together, an attacker could achieve remote code execution.
Containers
Yes
Yes
User
- v1.30.0 to v1.30.2
- v1.29.0 to v1.29.6
- <= v1.28.11
- v1.31.0
- v1.30.3
- v1.29.7
- v1.28.12
This security issue has been rated Critical with a 9.8 CVSS score for images built with the Proxmox provider. |
This security issue has been rated Medium with a 6.3 CVSS score for images built with Nutanix, OVA, QEMU, or raw providers. |
Managed Service | Yes | No | Planned |
8.1 | High | Yes | Not Applicable | User |
9.9 | Critical | Not Applicable | Not Applicable | Not Applicable |
9.8 | Critical | Yes | Planned | IONOS Cloud |
9.0 | Critical | Yes | Not Applicable | Not Applicable |
8.8 | High | Yes | October 7, 2024 and Done | IONOS Cloud |
8.1 | Critical | Yes | July 2, 2024 and In Progress | IONOS Cloud |
9.8 | Critical | Not Applicable | Not Applicable | Not Applicable |
8.2 | High | Yes | May 6, 2024 and In Progress | Acronis |
10 | Critical | Not Applicable | Not Applicable | Not Applicable |
8.6 | High | Yes | February 5, 2024 | IONOS Cloud |
8.8 | High | Yes | November 16, 2023 | IONOS Cloud |
9.8 | Critical | Yes | November 6, 2023 | IONOS Cloud |
4.7 | Medium | Yes | October 13, 2023 and Ongoing | IONOS Cloud |
6.6 | Medium | No | IONOS Cloud |
7.1 | High | No | IONOS Cloud |
6.5 | Medium | Yes | August 14, 2023 | IONOS Cloud |
Images & Snapshots | Windows Images |
Images & Snapshots | Ubuntu Images |
Images & Snapshots | Debian Images |
Images & Snapshots | AlmaLinux Images |
Images & Snapshots | Rocky Linux Images |
Images & Snapshots | RHEL Images |
Images & Snapshots | ClearOS Images |
Images & Snapshots | Microsoft SQL Server Images |
Managed Kubernetes | Kubernetes resources |
Backup Service | Backup Agent |
PostgreSQL | PostgreSQL resources |
MongoDB | MongoDB resources |
Observability Products | No | Not Applicable | Not Applicable |
Observability Products | No | Not Applicable | Not Applicable |
On May 20, 2024, Tenable Research published information about a memory corruption vulnerability in Fluent Bit that may result in a denial of service, information disclosure, or remote code execution. For more information, refer to the Tenable Research Advisory.
The CVE ID CVE-2024-4323 is assigned to this vulnerability and classified as a Critical severity with a CVSS score of 9.8 by Tenable Research. For further technical details about the vulnerability, refer to Fluent Bit's official advisory.
IONOS Cloud infrastructure and services do not utilize the vulnerable software and are not impacted.
Users using Fluent Bit versions 2.0.7 through 3.0.3 in their Virtual Data Centers (VDCs) are vulnerable and must update their software to 2.2.3 or 3.0.4.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
On March 29, 2024, the Openwall oss-security mailing list published information about a backdoor in the compression utility/library xz/liblzma. This backdoor affects sshd in some rolling and testing Linux distributions. The CVE ID CVE-2024-3094 is assigned to this vulnerability and has a Critical severity with Common Vulnerability Scoring System (CVSS) of 10 score.
For more information, refer to the official Red Hat Blog.
IONOS Cloud infrastructure and services do not utilize the vulnerable software, so they are not impacted.
If you are using custom images, we advise you to refer to the information provided by the Operating System (OS) vendor to address any concerns from this reported issue.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
On July 01, 2024, OpenSSH disclosed a vulnerability in Portable OpenSSH versions between 8.5 and 9.7 that may allow arbitrary code execution with root privileges in default configurations. The vulnerability is named regreSSHion.
The CVE ID CVE-2024-6387 is assigned to this vulnerability and classified as Critical severity with a CVSS score of 8.1. For more information about the technical details of the vulnerability, refer to the official advisory.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
We do not see any sign of active exploitation of this vulnerability in our infrastructure or user environment. Cloud-provided compute engines already use the patched version of OpenSSH, so there is no risk to the cloud user environment.
IONOS Cloud has already started the patching process for the affected products and services. The patching status is complete for Compute Engine, is ongoing for Managed Kubernetes, and will be updated once completed.
Users using compute engines with affected distribution should patch as per the vendor security guidelines. No action is required from the users using the Managed Kubernetes environment.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
On April 29, 2024, Acronis disclosed multiple vulnerabilities in Cyber Protect Agent. As per the advisory published by Acronis, the following are the vulnerability details:
| CVE ID | Vulnerability |
|---|---|
The most severe of these vulnerabilities is CVE-2024-34010 and is classified as a High severity with CVSS score of 8.2. The attack vectors related to these vulnerabilities are still not known.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
There are no signs of active exploitation resulting from these vulnerabilities. These vulnerabilities do not allow unauthorized access to IONOS Cloud users’ backup data. IONOS Cloud is already in the process of rolling out patched agents for Storage & Backup users.
You can enable auto-update; the vulnerable agent is automatically updated after May 6, 2024. You can download the non-vulnerable agent from the Downloads section in the Backup Unit Management console if the auto-update is not enabled.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
On January 31, 2024, cybersecurity company Snyk disclosed a vulnerability in all versions of runc, up to and including 1.1.11, which is utilized by the Docker engine and other containerization technologies like Kubernetes.
The runc application is used for spawning and running containers on Linux. The vulnerability enables containerized escape for attackers that execute a malicious image or build an image using a malicious Dockerfile or an upstream image.
The CVE ID CVE-2024-21626 is assigned to this vulnerability and has a High severity with Common Vulnerability Scoring System (CVSS) of 8.6 score. For more information about the technical details of the vulnerability, see the official runc advisory and the analysis by Snyk.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
IONOS Cloud is committed to the privacy and security of our customers' data. We are aware of this vulnerability and have already initiated the required steps to mitigate this vulnerability. We own the patching responsibilities and have already completed patching to update runc version 1.1.12.
As a best practice, ensure that Docker images use trusted and verified sources. No patching is required from your end.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
On November 14th, 2023, Intel disclosed a vulnerability in its recent computer processor microarchitecture. This vulnerability, known as Redundant REX Prefix, may allow an attacker to confuse the system, resulting in unpredictable behavior. If an attacker successfully exploits this vulnerability, they could crash or hang the target system and, in some scenarios, allow an escalation of privilege, which may allow an attacker to obtain sensitive information from the system. This vulnerability is assigned CVE ID CVE-2023-23583 and has been given a high severity of 8.8 score by Intel.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
IONOS Cloud is committed to the privacy and security of our customers' data. We have already completed the required steps to mitigate this vulnerability by upgrading the affected systems' firmware. IONOS Cloud owns the patching responsibility, and no action is required from the customer.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
Compute Services
Yes
Yes
Done
Containers
Yes
No
In Progress
Related to local privilege escalation. These vulnerabilities allow an attacker to escalate their privileges.
Manipulates sensitive information without authorization.
Storage & Backup
No
Not Applicable
Not Applicable
Storage & Backup
Acronis Agent for Windows, Linux, and Mac
Yes
In Progress
May 6, 2024
Containers
Yes
Yes
Done
Compute Services
Yes
Yes
Done
Compute Services
Yes
Yes
Done
On October 25, 2023, VMWare disclosed a vulnerability in its vCenter Server Security Issues. This vulnerability enables a malicious actor with network access to a vCenter Server to trigger an out-of-bounds write – potentially leading to remote code execution. The CVE ID CVE-2023-34048 is assigned to this vulnerability and has a Critical severity with Common Vulnerability Scoring System (CVSS) of 9.8 score.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
IONOS Cloud customers access their Private Cloud’s vCenter server via an IONOS-provided dedicated Virtual Private Network (VPN). Every Private Cloud customer has a dedicated VPN, and another customer of IONOS cannot access the vCenter Server instance of another. This reduces the attack surface from external entities. Therefore, we consider this issue to be Medium for our customer environment as the reachability of the attack is not public but restricted.
We do not see any active sign of exploitation of this vulnerability, and no public exploit is known yet.
IONOS Cloud provides VServer over a secure virtual private network, which mitigates the risk of exploitation from external entities. We have already initiated the steps to remediate the vulnerability by upgrading the VMWare vCenter version. IONOS Cloud owns the patching responsibility, and there is no action required from the customer.
IONOS Cloud will start to update all VMware vCenter servers on November 6, 2023.
During the upgrade, you can restrict access to vCenter for up to 1 hour.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
On August 8th, 2023, Advanced Micro Devices (AMD) disclosed a vulnerability in its recent computer processor microarchitecture. This vulnerability, known as the Return Form Procedure (RET) Speculation or Inception, may allow an attacker to obtain sensitive information from a system.
If an attacker can exploit this vulnerability, they could potentially exfiltrate information contained within different security contexts such as other or even the host device.
The CVE ID is assigned to this vulnerability and classified as a medium severity by AMD.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|
IONOS Cloud is committed to the privacy and security of our customers' data. We are aware of this vulnerability and have already initiated the required steps to mitigate this vulnerability. We are also investigating the exposure and risk of this vulnerability for our customer’s products and instances.
We will provide necessary updates as we learn more.
If you have further questions or concerns about this vulnerability, contact .
vCenter Server
Yes
No
Not Started
Compute Services | Yes | Yes | Done |
Compute Services | Yes | Yes | Done |
Compute Services | Yes | In Progress | In Progress |
On August 8th, 2023, Intel disclosed a vulnerability in its recent computer processor microarchitecture. This vulnerability, known as "Gather Data Sampling (GDS)" or "Downfall", may allow an attacker to obtain sensitive information from a system. This vulnerability is assigned CVE ID as and has been given a medium severity by Intel.
CVE-2022-40982 is a transient execution side-channel vulnerability that affects Intel® Core processors from the 6th Generation (Skylake) to the 11th Generation (Tiger Lake). It allows an attacker with local access to infer stale data from previously used vector registers on the same physical core. A detailed description can be found in the .
If an attacker is able to exploit this vulnerability, they could potentially exfiltrate information contained within different security contexts (i.e., other virtual machines or even the host device).
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|
IONOS Cloud is committed to the privacy and security of our customers' data. We are aware of this vulnerability and have already initiated the required steps to mitigate this vulnerability. We are also investigating the exposure and risk of this vulnerability for our customer’s products and instances.
We will provide necessary updates as we learn more.
If you have further questions or concerns about this vulnerability, contact .
Compute Services | Yes | Yes | Done |
Compute Services | Yes | Yes | Done |
Compute Services | Yes | Yes | Done |
On October 9, 2023, Acronis disclosed a vulnerability in its Acronis Agent for Linux, Mac, and Windows. This vulnerability may allow an unauthorized attacker to view and manipulate antivirus and antimalware protection plans applied to a specific agent. CVE-2023-45247 ID has been assigned to this vulnerability and classified as having high severity.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
IONOS and Acronis are in constant communication to gain a deeper understanding of this vulnerability and also ensure that:
There are no signs of active exploitation resulting from the vulnerability. For more information, see Acronis Cyber Protect Cloud Agent update C23.10.
The vulnerability does not allow unauthorized access to IONOS Cloud customers’ backup data. IONOS Cloud will publish the non-vulnerable versions of agents when Acronis shares the information, estimated to be by the end of November 2023.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
On October 9, 2023, Acronis disclosed another vulnerability in its Acronis Agent for Windows. The vulnerability can be fixed by upgrading to build version 36497.
| Product Ranges | Product | Impacted | Mitigated | Patch Status |
|---|---|---|---|---|
The IONOS Cloud team constantly communicates with Acronis and will soon allow customers to download the patched Windows agent. Acronis has ensured no active sign of exploitation, and IONOS Cloud customer backups do not have an impact due to this vulnerability. For more information, see Acronis Cyber Protect Cloud Agent update C23.10.
IONOS Cloud will publish the non-vulnerable versions of agents when Acronis shares the information, estimated to be by the end of November 2023.
If you have further questions or concerns about this vulnerability, contact IONOS Cloud Support.
Storage & Backup
No
Not applicable
Not applicable
Storage & Backup
Acronis Agent for Windows, Linux, and Mac
Yes
No
Will be available in late November
Storage & Backup
No
Not applicable
Not applicable
Storage & Backup
Acronis Agent for Windows
Yes
No
Will be available in late November