Lucene search

K
ibmIBM799823FEACD360943633A51415DF96A8C5E2C70F9725F87AB43B97BA3A3A30C3
HistoryFeb 24, 2023 - 9:49 p.m.

Security Bulletin: IBM Security Verify Bridge (windows and docker versions) affected by a denial of service issue in Go (CVE-2022-32149)

2023-02-2421:49:20
www.ibm.com
27
ibm security verify bridge
windows
docker
go
denial of service
vulnerability
component upgrade

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

62.1%

Summary

IBM Security Verify Bridge (windows and docker versions) fixed the vulnerability by upgrading the Go component to the proper version containing all fixes.

Vulnerability Details

**CVEID:**CVE-2022-32149 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation by the golang.org/x/text/language package. By sending a specially-crafted Accept-Language header, a remote attacker could exploit this vulnerability to cause ParseAcceptLanguage to take significant time to parse, and results in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238605 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Security Verify Bridge Windows v1.0.12 Docker v1.0.12.0

Remediation/Fixes

IBM encourages customers to update their systems promptly.

For IBM Security Verify Bridge (windows), update to version 1.0.13: https://exchange.xforce.ibmcloud.com/hub/extension/1c7235901d5d37bf06665ce56d5ab426

For IBM Security Verify Bridge (docker), update to version 1.0.13.0: https://hub.docker.com/r/ibmcom/verify-bridge

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmsecurity_verifyMatch1.0.13
VendorProductVersionCPE
ibmsecurity_verify1.0.13cpe:2.3:a:ibm:security_verify:1.0.13:*:*:*:*:*:*:*

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

62.1%