Security Bulletin: IBM Observability with Instana for Synthetic PoP is affected by Multiple Security Vulnerabilities

Summary

Multiple vulnerabilities were addressed in IBM Observability with Instana for Synthetic PoP build 268

Vulnerability Details

CVEID:CVE-2023-22041
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the VM component could allow a local attacker to cause high confidentiality impacts.
CVSS Base score: 5.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261045 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2023-42282
**DESCRIPTION:**Node.js IP package could allow a remote attacker to execute arbitrary code on the system, caused by a server-side request forgery flaw in the ip.isPublic() function. By sending a specially crafted request using a hexadecimal representation of a private IP address, an attacker could exploit this vulnerability to execute arbitrary code on the system and obtain sensitive information.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282923 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana for Synthetic PoP to the latest release as described here:

<https://www.ibm.com/docs/en/instana-observability/current?topic=saas-build-268#synthetic-monitoring&gt;

Workarounds and Mitigations

None