Security Bulletin: IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.8.1 is affected but not considered vulnerable to multiple vulnerabilities

Summary

IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.8.1 is affected but not classified as vulnerable to multiple vulnerabilities based on current information, in the following 3rd-party components: Ansible and Logrus. These 3rd-party have been upgraded to non-vulnerable versions.

Vulnerability Details

CVEID:CVE-2023-5115
**DESCRIPTION:**Ansible could allow a remote attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially crafted URL request containing “dot dot” sequences (/…/) to overwrite arbitrary files outside of the extraction path.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268276 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N)

CVEID:CVE-2023-4237
**DESCRIPTION:**Red Hat Ansible Automation Platform could allow a local authenticated attacker to obtain sensitive information, caused by the exposure of private key directly to the standard output when creating a new keypair. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain private key information, and use this information to launch further attacks against the affected system.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268605 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

**IBM X-Force ID:**255317
**DESCRIPTION:**Logrus is vulnerable to a denial of service, caused by a flaw in the bufio.Scanner log writer. By logging more than 64kb of data in a single entry without newlines, a local attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/255317 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

It is strongly recommended that you apply the most recent security update:

Workarounds and Mitigations

None