Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM791AC69D7B6B4B452A326C6D9FFB87B07CA0563C7F36D2B1BC0220E608F7CE92
HistoryDec 14, 2023 - 2:18 p.m.

Security Bulletin: IBM Maximo Application Suite uses gevent-21.1.2-cp37-cp37m-manylinux2010_x86_64.whl which is vulnerable to CVE-2023-41419

2023-12-1414:18:32
www.ibm.com
6
ibm maximo application suite
gevent vulnerability
cve-2023-41419
iot component
fixpack
catalog
update available

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON

Summary

IBM Maximo Application Suite uses gevent-21.1.2-cp37-cp37m-manylinux2010_x86_64.whl which is vulnerable to CVE-2023-41419. This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2023-41419
**DESCRIPTION:**Gevent could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the WSGIServer component. By using a specially crafted script , an attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/267078 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Maximo Application Suite - IoT Component 8.7
IBM Maximo Application Suite - IoT Component 8.8

Remediation/Fixes

Affected Product(s) Fixpack Version(s)
IBM Maximo Application Suite - IoT Component 8.7.6 or the latest (available from the Catalog under Update Available)
IBM Maximo Application Suite - IoT Component 8.8.2 or the latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmmaximo_application_suiteMatch8.7
OR
ibmmaximo_application_suiteMatch8.8

Related

osv 3
ibm 4
nvd 1
veracode 1
cbl_mariner 1
openvas 1
redhat 1
nessus 4
ubuntucve 1
redhatcve 1
wolfi 1
cvelist 1
cgr 1
cve 1
prion 1
github 1
osv
osv
PYSEC-2023-177
2023-09-25 12:15:00
Gevent allows remote attacker to escalate privileges
2023-09-25 12:30:44
CVE-2023-41419
2023-09-25 12:15:11
ibm
ibm
Security Bulletin: Gevent, used in IBM Maximo Application Suite - Monitor Component, is vulnerable to CVE-2023-41419 which allows remote attackers to escalate privileges.
2023-12-12 17:24:15
Security Bulletin: Vulnerability in CloudPak for Watson AIOps. [CVE-2023-41419]
2023-10-25 20:26:21
Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
2024-05-10 15:38:46
nvd
nvd
CVE-2023-41419
2023-09-25 12:15:11
veracode
veracode
HTTP Request/Response Smuggling
2023-09-27 10:19:40
cbl_mariner
cbl_mariner
CVE-2023-41419 affecting package python-gevent for versions less than 1.3.6-9
2023-11-08 02:07:28
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2023:4091-1)
2023-10-18 00:00:00
redhat
redhat
(RHSA-2023:7438) Important: Red Hat OpenStack Platform 17.1.1 (python-gevent) security update
2023-11-21 15:40:36
nessus
nessus
RHEL 9 : Red Hat OpenStack Platform 17.1.1 (python-gevent) (RHSA-2023:7438)
2024-04-28 00:00:00
RHEL 7 : python-gevent (Unpatched Vulnerability)
2024-06-03 00:00:00
SUSE SLED15 / SLES15 Security Update : python-gevent (SUSE-SU-2023:4091-1)
2023-10-18 00:00:00
ubuntucve
ubuntucve
CVE-2023-41419
2023-09-25 00:00:00
redhatcve
redhatcve
CVE-2023-41419
2023-09-25 18:55:01
wolfi
wolfi
CVE-2023-41419 vulnerabilities
2024-06-25 03:08:26
cvelist
cvelist
CVE-2023-41419
2023-09-25 00:00:00
cgr
cgr
CVE-2023-41419 vulnerabilities
2024-05-19 03:07:16
cve
cve
CVE-2023-41419
2023-09-25 12:15:11
prion
prion
Design/Logic Flaw
2023-09-25 12:15:00
github
github
Gevent allows remote attacker to escalate privileges
2023-09-25 12:30:44

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON
Related for 791AC69D7B6B4B452A326C6D9FFB87B07CA0563C7F36D2B1BC0220E608F7CE92
osv3ibm4nvd1veracode1cbl_mariner1openvas1redhat1nessus4ubuntucve1redhatcve1wolfi1cvelist1cgr1cve1prion1github1