IBM80FCB350945A9F9C2E5F64E6D983BE38D14C71BACF2156E2778061AF6C7ADE2CSecurity Bulletin: IBM DataPower Gateway is vulnerable to denial of service due to Golang Go
AI Score
Confidence
High
Summary
IBM DataPower Gateway is vulnerable to denial of service due to use of Golang Go in DataPower Operator and Prometheus Metrics . (CVE-2024-24783)
Vulnerability Details
CVEID:CVE-2024-24783
**DESCRIPTION:**Golang Go is vulnerable to a denial of service, caused by a flaw in the crypto/x509 package when verifying a certificate chain. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause Certificate.Verify to panic, and results in a denial of service condition.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/285303 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| DataPower Operator 1.8 | 1.8.0 - 1.8.1 |
| DataPower Operator 1.6 | 1.6.0 - 1.6.13 |
| DataPower Operator 1.7 | 1.7.0 - 1.7.2 |
| DataPower Operator 1.9 | 1.9.0 - 1.9.1 |
| IBM DataPower Gateway 10.5 CD | 10.5.1.0 - 10.5.4.0 |
| IBM DataPower Gateway 10.5.0 | 10.5.0.0 - 10.5.0.10 |
| IBM DataPower Gateway 10.0.1 | 10.0.1.0 - 10.0.1.18 |
Remediation/Fixes
| Affected Product(s) | Fixed in version | APAR |
|---|---|---|
| DataPower Operator 1.6 | 1.6.14, 1.10.1 | IT45777 |
| DataPower Operator 1.7 | 1.11.0 | IT45777 |
| DataPower Operator 1.8 | 1.6.14, 1.10.1 | IT45777 |
| DataPower Operator 1.9 | 1.6.14, 1.10.1 | IT45777 |
| IBM DataPower Gateway 10.5 CD | 10.6.0.0 | IT45777 |
| IBM DataPower Gateway 10.5.0 | 10.5.0.11 | IT45777 |
| IBM DataPower Gateway 10.0.1 | 10.0.1.19 | IT45777 |
IBM strongly recommends addressing this vulnerability by upgrading to a fixed version
Workarounds and Mitigations
None
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | datapower_gateway | 10.0.1 | cpe:2.3:a:ibm:datapower_gateway:10.0.1:*:*:*:*:*:*:* |
| ibm | datapower_gateway | 10.5.0 | cpe:2.3:a:ibm:datapower_gateway:10.5.0:*:*:*:*:*:*:* |
| ibm | datapower_gateway | 10.5 | cpe:2.3:a:ibm:datapower_gateway:10.5:*:*:*:*:*:*:* |
Related
AI Score
Confidence
High