Security Bulletin: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise edition are affected by James Clark Expat Vulnerabilities

Summary

IBM Cloud Orchestrator has addressed the following vulnerabilities.

Vulnerability Details

CVEID: CVE-2013-0340**
DESCRIPTION:** expat is vulnerable to a denial of service, caused by the improper handling of internal entity expansion. By persuading a victim to open a specially crafted XML document, an attacker could exploit this vulnerability to consume all available resources.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/132738 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2013-0341**
DESCRIPTION:** expat is vulnerable to a denial of service, caused by the improper handling of external entity expansion. By persuading a victim to open a specially crafted XML document, an attacker could exploit this vulnerability to consume all available resources.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/132741 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

Affected Products and Versions

Affected IBM Cloud Orchestrator

|

Affected Versions

—|—
IBM Cloud Orchestrator| 2.5
IBM Cloud Orchestrator| 2.4
br>
br>

Remediation/Fixes

Fix delivery details for IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition:

Workarounds and Mitigations

None