Lucene search

IBM0EED7AFD9E6BAEC7DA4E60001C5B1859D9F0BCD21EBA1B2EC39060BE05B2BDF0

HistoryJun 07, 2024 - 6:47 a.m.

Security Bulletin: IBM Asset Data Dictionary Component uses jose4j-0.9.3.jar which is vulnerable to CVE-2023-51775.

2024-06-0706:47:03

www.ibm.com

ibm asset data dictionary

vulnerability

cve-2023-51775

jose4j-0.9.3.jar

denial of service

input validation

cvss

remediation

software

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Summary

IBM Asset Data Dictionary Component uses jose4j-0.9.3.jar which is vulnerable to CVE-2023-51775. This bulletin contains information regarding the vulnerability and its remediation.

Vulnerability Details

CVEID:CVE-2023-51775
**DESCRIPTION:**jose4j is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted p2c value, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/275907 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Asset Data Dictionary Component	1.1

Remediation/Fixes

Remediated Product(s)	Version(s)
IBM Asset Data Dictionary Component	1.1.8

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmaximo_application_suiteMatch8.10

ibmmaximo_application_suiteMatch8.11

CPENameOperatorVersion
ibm maximo application suiteeq8.10
ibm maximo application suiteeq8.11

CPE	Name	Operator	Version
	ibm maximo application suite	eq	8.10
	ibm maximo application suite	eq	8.11