Is Performance Management impacted by CVE-2021-4034 vulnerability (polkit's pkexec utility)

Products

• CA Performance Management - Usage and Administration
• DX NetOps

Issue/Introduction

Security team received a bulletin about an high security vulnerability on polkit's pkexec utility affecting all major Linux distributions.
This could allow the execution of arbitrary code with privileged access.

The link to relevant CVE-2021-4034 vulnerability is: https://nvd.nist.gov/vuln/detail/CVE-2021-4034

An unprivileged user can use specially crafted variables to exploit pkexec’s counting of parameters flaw and result in the execution of arbitrary code with administrative rights.

Is NetOps Performance Management exposed to this vulnerability?

 

Environment

Release : 20.2 & 21.2

Component : All components

Resolution

NetOps Performance Management does not use polkit's pkexec utility, so it is not affected by this vulnerability.