Security Bulletin: The Transformation Advisor Tool in IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Johnzon (CVE-2023-33008)

Summary

The Transformation Advisor Tool in IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Johnzon (CVE-2023-33008).

Vulnerability Details

CVEID:CVE-2023-33008
**DESCRIPTION:**Apache Johnzon is vulnerable to a denial of service, caused by an unsafe deserialization flaw in BigDecimal. By sending a specially crafted JSON input, a remote attacker could exploit this vulnerability to cause a slow conversion, and results in a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/259976 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise

Interim Fix for APAR (IT44418) is available to apply to 12.0.9.0 from

IBM Fix Central

IBM App Connect Enterprise| 11.0.0.1 - 11.0.0.22| IT44418| Interim Fix for APAR (IT44418) is available to apply to 11.0.0.22 from

IBM Fix Central

Workarounds and Mitigations

None