Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to security restrictions bypass

Summary

Pulsar is used by IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library. [CVE-2023-51437] The below vulnerability have been addressed.

Vulnerability Details

CVEID:CVE-2023-51437
**DESCRIPTION:**Apache Pulsar could allow a remote attacker to bypass security restrictions, caused by an observable timing discrepancy in SASL Authentication Provider. An attacker could exploit this vulnerability to forge an SASL Role Token that will pass signature verification.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/281597 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Transport Module Common Integration Library

|

common-transportmodule-29_0 up to and including common-transportmodule-38_4.

Remediation/Fixes

Product(s)

|

Version(s)

|

Remediation / First Fix

—|—|—

Transport Module Common Integration Library

|

common-transportmodule-39_0

|

Refer to release notice for the part number of the new package and instructions for the upgrade.

Workarounds and Mitigations

None