CVE-2024-7142

Vendor solution

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.

For more information about upgrading see CloudVision Appliance 350E-CV - Arista https://www.arista.com/en/qsg-cva-350e-cv .

CVE-2024-7142 has been fixed in the following releases:

* CVA 6.0.7

If the user runs the cva disk encryption enable command in the aforementioned releases containing the fix, the disks will be properly encrypted.

In addition, the upgrade from a vulnerable CVA version to the versions mentioned above will fix the issue automatically.

* If the key/password pair is found during the upgrade, the upgrade process will encrypt the disks properly. Just to be clear, if this upgrade process does not notice the corresponding key/password pair on the system, it will preserve the original intent of the user and will not encrypt the disks. 

* If the user no longer wants to encrypt the disks even though they previously ran cva disk encryption enable command on a vulnerable release, cva disk encryption disable command must be run before the upgrade. This disable option will not be available on the new releases