Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM7F469576AFEA479905C88DE107EB5424AC26833B5BE44E4174DEC3BADB1A0BA5
HistoryJul 04, 2024 - 12:59 p.m.

Security Bulletin: Denial of Service vulnerabilities in Apache Commons Compress affect IBM Business Automation Workflow - CVE-2024-25710, CVE-26308

2024-07-0412:59:02
www.ibm.com
8
ibm business automation workflow
denial of service
apache commons compress
vulnerability
cve-2024-25710
cve-26308
interim fix
cumulative fix
security bulletin

CVSS3

8.1

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

8.1

Confidence

High

JSON

Summary

IBM Business Automation Workflow is vulnerable to denial of service attacks.

Vulnerability Details

CVEID:CVE-2024-25710
**DESCRIPTION:**Apache Commons Compress is vulnerable to a denial of service, caused by an infinite loop flaw. By persuading a victim to open a specially crafted DUMP file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/283472 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

CVEID:CVE-2024-26308
**DESCRIPTION:**Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error. By persuading a victim to open a specially crafted Pack200 file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/283469 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s) Status
IBM Business Automation Workflow containers

V23.0.2 - V23.0.2-IF032
V23.0.1 all fixes
V22.0.2 all fixes
V22.0.1 all fixes
V21.0.3 - V21.0.3-IF004
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes

| affected
IBM Business Automation Workflow traditional| V23.0.1 - V23.0.2
V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3| affected
IBM Business Automation Workflow Enterprise Service Bus| V23.0.1 - V23.0.2
V22.0.2| affected

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT386610 as soon as practical.

Affected Product(s) Version(s) Remediation / Fix
IBM Business Automation Workflow containers V23.0.2 Apply 23.0.2-IF005
IBM Business Automation Workflow containers V21.0.3 Apply 21.0.3-IF033
or upgrade to 23.0.2-IF005 or later
IBM Business Automation Workflow containers V23.0.1
V22.0.1 - V22.0.2
V21.0.1 - V21.0.2
V20.0.0.1 - V20.0.0.2 Upgrade to 21.0.3-IF033
or upgrade to 23.0.2-IF005 or later
IBM Business Automation Workflow traditional and IBM Business Automation Workflow Enterprise Service Bus V23.0.2 Apply DT386610
IBM Business Automation Workflow traditional V21.0.3.1 Apply DT386610
IBM Business Automation Workflow traditional

V23.0.1
V22.0.1 - V22.0.2
V21.0.1 - V21.0.3.0
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.1 - V18.0.0.3

| Upgrade to a long term support release or the latest SSCD version. See IBM Business Automation Workflow and IBM Integration Designer Software Support Lifecycle Addendum

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmbusiness_automation_workflowMatch18.0.0.0
OR
ibmbusiness_automation_workflowMatch18.0.0.1
OR
ibmbusiness_automation_workflowMatch18.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.1
OR
ibmbusiness_automation_workflowMatch19.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.3
OR
ibmbusiness_automation_workflowMatch20.0.0.1
OR
ibmbusiness_automation_workflowMatch20.0.0.2
OR
ibmbusiness_automation_workflowMatch21.0.2
OR
ibmbusiness_automation_workflowMatch21.0.3
OR
ibmbusiness_automation_workflowMatch22.0.1
OR
ibmbusiness_automation_workflowMatch22.0.2
OR
ibmbusiness_automation_workflowMatch23.0.1
OR
ibmbusiness_automation_workflowMatch23.0.2
OR
ibmbusiness_automation_workflowMatch22.0.2enterprise_service_bus
OR
ibmbusiness_automation_workflowMatch23.0.1enterprise_service_bus
OR
ibmbusiness_automation_workflowMatch23.0.2enterprise_service_bus
VendorProductVersionCPE
ibmbusiness_automation_workflow18.0.0.0cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.1cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.2cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.1cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.2cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.3cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.1cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.2cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow21.0.2cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:*:*:*:*:*:*:*
Rows per page:
1-10 of 171

Related

ibm 49
openvas 3
redhat 11
nessus 11
nvd 2
osv 24
cve 2
githubexploit 1
cgr 2
veracode 2
debiancve 2
github 2
vulnrichment 2
prion 2
ubuntucve 2
cvelist 2
redhatcve 2
wolfi 2
amazon 1
atlassian 1
oracle 2
ibm
ibm
Security Bulletin: Security vulnerabilities in Apache Commons Compress affects IBM License Metric Tool v9.
2024-03-19 13:38:34
Security Bulletin: IBM License Key Server Administration & Reporting Tool and Agent are vulnerable to avulnerability in Apache Commons Compress Library
2024-07-30 16:37:20
Security Bulletin: IBM DevOps Deploy / IBM Urbancode Deploy (UCD) is vulnerable to denial of service due to Apache Commons Compress ( CVE-2024-25710, CVE-2024-26308 )
2024-04-11 19:06:08
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2024:0726-1)
2024-03-01 00:00:00
Apache Commons Compress 1.21 < 1.26.0 DoS Vulnerability
2024-02-20 00:00:00
Apache Commons Compress 1.3 < 1.26.0 DoS Vulnerability
2024-02-20 00:00:00
redhat
redhat
(RHSA-2024:1509) Moderate: Red Hat Data Grid 8.4.7 security update
2024-03-26 11:13:37
(RHSA-2024:1797) Important: Red Hat build of Quarkus 2.13.9.SP2 release and security update
2024-04-22 10:57:23
(RHSA-2024:1948) Important: Red Hat Build of Apache Camel 3.18 for Quarkus 2.13 is now available (updates to RHBQ 2.13.9.SP2)
2024-04-22 13:28:12
nessus
nessus
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : Java (SUSE-SU-2024:0726-1)
2024-03-01 00:00:00
Amazon Linux 2023 : apache-commons-compress, apache-commons-compress-javadoc (ALAS2023-2024-560)
2024-03-21 00:00:00
Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2024-561)
2024-03-21 00:00:00
nvd
nvd
CVE-2024-26308
2024-02-19 09:15:38
CVE-2024-25710
2024-02-19 09:15:37
osv
osv
Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
2024-02-19 09:30:52
CGA-ggv5-qcv7-p79c
2024-06-06 12:27:27
CGA-x85q-h487-67fx
2024-06-06 12:29:56
cve
cve
CVE-2024-26308
2024-02-19 09:15:38
CVE-2024-25710
2024-02-19 09:15:37
githubexploit
githubexploit
Exploit for Allocation of Resources Without Limits or Throttling in Apache Commons Compress
2024-08-11 14:10:14
cgr
cgr
CVE-2024-26308 vulnerabilities
2024-05-19 03:07:16
CVE-2024-25710 vulnerabilities
2024-05-19 03:07:16
veracode
veracode
Denial Of Service (DoS)
2024-02-20 06:39:51
Denial Of Service (DoS)
2024-02-20 06:21:30
debiancve
debiancve
CVE-2024-26308
2024-02-19 09:15:38
CVE-2024-25710
2024-02-19 09:15:37
github
github
Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
2024-02-19 09:30:52
Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
2024-02-19 09:30:50
vulnrichment
vulnrichment
CVE-2024-26308 Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
2024-02-19 08:31:50
CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
2024-02-19 08:33:40
prion
prion
Code injection
2024-02-19 09:15:00
Design/Logic Flaw
2024-02-19 09:15:00
ubuntucve
ubuntucve
CVE-2024-26308
2024-02-19 00:00:00
CVE-2024-25710
2024-02-19 00:00:00
cvelist
cvelist
CVE-2024-26308 Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
2024-02-19 08:31:50
CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
2024-02-19 08:33:40
redhatcve
redhatcve
CVE-2024-26308
2024-02-19 20:50:29
CVE-2024-25710
2024-02-19 20:50:19
wolfi
wolfi
CVE-2024-26308 vulnerabilities
2024-09-18 21:11:55
CVE-2024-25710 vulnerabilities
2024-09-18 21:11:55
amazon
amazon
Important: apache-commons-compress
2024-03-13 20:26:00
atlassian
atlassian
Bitbucket Data Center is affected by CVE-2024-25710
2024-04-03 08:56:14
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00

CVSS3

8.1

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

8.1

Confidence

High

JSON
Related for 7F469576AFEA479905C88DE107EB5424AC26833B5BE44E4174DEC3BADB1A0BA5
ibm49openvas3redhat11nessus11nvd2osv24cve2githubexploit1cgr2veracode2debiancve2github2vulnrichment2prion2ubuntucve2cvelist2redhatcve2wolfi2amazon1atlassian1oracle2