Security Bulletin: IBM DataPower Gateway vulnerable to DoS due to OpenSSL (CVE-2024-2511)

2024-07-0915:27:05

www.ibm.com

ibm datapower gateway

openssl

dos

cve-2024-2511

tls functionality

AI Score

8.1

Confidence

High

JSON

Summary

OpenSSL is used to provide TLS functionality within IBM DataPower Gateway

Vulnerability Details

CVEID:CVE-2024-2511
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by improper server configuration validation. By using a specially crafted server configuration, a remote attacker could exploit this vulnerability to cause unbounded memory growth, and results in a denial of service condition.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/287215 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM DataPower Gateway 10.5 CD	10.5.1.0 - 10.5.4.0
IBM DataPower Gateway 10.5.0	10.5.0.0 - 10.5.0.11

Remediation/Fixes

Affected Product	Fixed in version	APAR
IBM DataPower Gateway 10.5CD	10.6.0.0	IT46104
IBM DataPower Gateway 10.5.0	10.5.0.12	IT46104

IBM recommends addressing the vulnerability now

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmdatapower_gatewayMatch10.5.0

ibmdatapower_gatewayMatch10.5

VendorProductVersionCPE
ibmdatapower_gateway10.5.0cpe:2.3:a:ibm:datapower_gateway:10.5.0:*:*:*:*:*:*:*
ibmdatapower_gateway10.5cpe:2.3:a:ibm:datapower_gateway:10.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	datapower_gateway	10.5.0	cpe:2.3:a:ibm:datapower_gateway:10.5.0:::::::*
ibm	datapower_gateway	10.5	cpe:2.3:a:ibm:datapower_gateway:10.5:::::::*