Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues

Summary

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below.

Vulnerability Details

CVEID:CVE-2011-1675
**DESCRIPTION:**util-linux could allow a local attacker bypass security restrictions, caused by attempting to append to the /etc/mtab file without first checking whether resource limits would interfere by vmware-hgfsmounter. An attacker could exploit this vulnerability using a process with a RLIMIT_FSIZE value to corrupt the file and launch further attacks on the system.
CVSS Base score: 3.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/66705 for the current score.
CVSS Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:N)

CVEID:CVE-2011-1676
**DESCRIPTION:**util-linux could allow a local attacker to bypass security restrictions, caused by the failure to remove the /etc/mtab.tmp file after a failed attempt to add a mount entry. An attacker could exploit this vulnerability to corrupt the file and launch further attacks on the system.
CVSS Base score: 3.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/66704 for the current score.
CVSS Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:N)

CVEID:CVE-2011-1677
**DESCRIPTION:**An unspecified error in mount within util-linux related to the failure to remove the /etc/mtab~ lock file after a failed attempt to add a mount entry has an unknown impact and local attack vector.
CVSS Base score: 1.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/66703 for the current score.
CVSS Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:N)

CVEID:CVE-2021-22897
**DESCRIPTION:**cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. An attacker could exploit this vulnerability to expose data element to wrong session.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203609 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2021-22922
**DESCRIPTION:**cURL libcurl could allow a remote attacker to bypass security restrictions, caused by not removing incorrect content by the metalink feature. By persuading a victim to download specially-crafted content, an attacker could exploit this vulnerability to access malicious content to keep in the file on disk for further attack.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/206045 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:CVE-2021-22926
**DESCRIPTION:**Curl libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw in the CURLOPT_SSLCERT option mixup with TLS library Secure Transport. By creating a specially-crafted file name with the same name as the app wants to use by name, an attacker could exploit this vulnerability to trick the application to use the file based cert instead of the one referred to by name, and allow libcurl to send the wrong client certificate in the TLS connection handshake.
CVSS Base score: 9.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/206320 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:CVE-2021-22947
**DESCRIPTION:**cURL libcurl is vulnerable to a man-in-the-middle attack, caused by a flaw when connecting to an IMAP, POP3, SMTP or FTP server to exchange data securely using STARTTLS to upgrade the connection to TLS level. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/209453 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:CVE-2023-0687
**DESCRIPTION:**GNU C Library (glibc) is vulnerable to a buffer overflow, caused by improper bounds checking by the function __monstartup of the file gmon.c of the component Call Graph Monitor. By sending an overly long argument, a remote authenticated attacker from within the local network could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 4.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/246582 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2023-52425
**DESCRIPTION:**libexpat is vulnerable to a denial of service, caused by improper system resource allocation. By sending a specially crafted request using an overly large token, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/281438 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2024-28757
**DESCRIPTION:**libexpat could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity (XXE) declarations by the XML_ExternalEntityParserCreate function. By using a specially crafted XML content, a remote attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/285604 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Product(s)|**Version(s)
**|Remediation/Fix/Instructions
—|—|—
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data| 4.8.5| The fix in 4.8.5 applies to all versions listed (4.0.0-4.8.4). Version 4.8.5 can be downloaded and installed from: <https://www.ibm.com/docs/en/cloud-paks/cp-data&gt;

Workarounds and Mitigations

None