Lucene search

K
ibmIBM7AF05043E21FEBDD0B7090FE6C88ACE640F6B46265CC88EB13C38E8990B0868A
HistoryApr 02, 2024 - 9:36 a.m.

Security Bulletin: Vulnerability in Pillow affects IBM Process Mining CVE-2023-50447

2024-04-0209:36:09
www.ibm.com
14
pillow
ibm process mining
cve-2023-50447
remote attacker
arbitrary code
vulnerability
security fixes
openshift
installation
upgrade

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

32.0%

Summary

There is a vulnerability in Pillow that could allow an remote attacker to execute arbitrary code on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability.

Vulnerability Details

CVEID:CVE-2023-50447
**DESCRIPTION:**Pillow could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the PIL.ImageMath.eval function. By sending a specially crafted request using keys that leverage the environment parameter, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/280022 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Process Mining

1.14.0, 1.14.1, 1.14.2, 1.14.2 IF001, 1.14.3, 1.14.3 IF001

Remediation/Fixes

Any open source library may be included in one or more sub-components of IBM Process Mining. Open source updates are not always synchronized across all components. The CVE in this bulletin are specifically addressed by

Product(s) **Version(s) number and/or range ** Remediation/Fix/Instructions
IBM Process Mining on RedHat OpenShift

1.14.0, 1.14.1, 1.14.2, 1.14.2 IF001, 1.14.3, 1.14.3 IF001

| **Install/Upgrade to version 1.14.4

Installing a Production deployment
1.**To deploy a Production deployment, see installing on
RedHat OpenShift Container Platform environments

**Upgrading an Installation **** **1.To perform an upgrade of a Production deployment, see
upgrading in RedHat OpenShift Container Platform
environments
IBM Process Mining traditional|

1.14.0, 1.14.1, 1.14.2, 1.14.3

| **Install/Upgrade to version 1.14.4

** 1.Login to PassPortAdvantage
2.Search for
M0HJMML Process Mining 1.14.4 Server Multiplatform
Multilingual
3.Download package
4.Follow install instructions
5.Repeat for M0HJNML Process Mining 1.14.4 Client
Windows Multilingual

Workarounds and Mitigations

None known

Affected configurations

Vulners
Node
ibmrobotic_process_automation_as_a_serviceMatch1.14.0
OR
ibmrobotic_process_automation_as_a_serviceMatch1.14.1
OR
ibmrobotic_process_automation_as_a_serviceMatch1.14.2
OR
ibmrobotic_process_automation_as_a_serviceMatch1.14.2
OR
ibmrobotic_process_automation_as_a_serviceMatch001
OR
ibmrobotic_process_automation_as_a_serviceMatch1.14.3
OR
ibmrobotic_process_automation_as_a_serviceMatch1.14.3
OR
ibmrobotic_process_automation_as_a_serviceMatch001

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

32.0%