Lucene search

K
ibmIBM7CC5F589E9BC0C92DEF4BEF2121F2B963F810DD882E1C192E17454695CD02C28
HistoryFeb 24, 2023 - 10:40 a.m.

Security Bulletin: CVE-2022-32149 may affect IBM CICS TX Advanced

2023-02-2410:40:17
www.ibm.com
9

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

46.9%

Summary

CVE-2022-32149 related to golang package may affect IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2022-32149
**DESCRIPTION:**Golang Go is vulnerable to a denial of service, caused by improper input validation by the golang.org/x/text/language package. By sending a specially-crafted Accept-Language header, a remote attacker could exploit this vulnerability to cause ParseAcceptLanguage to take significant time to parse, and results in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238605 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM CICS TX Advanced 11.1

Remediation/Fixes

IBM recommends you apply these fixes.

Product

| VRMF|APAR|Remediation / First Fix
โ€”|โ€”|โ€”|โ€”
IBM CICS TX Advanced| 11.1| Updated packages related to Golang are built with an IFIX and IFIX is made available on Fix Central|

Linux: Fix Central Link

Workarounds and Mitigations

None

CPENameOperatorVersion
cics tx advancedeq11.1

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

46.9%