Lucene search

IBM8E8FFA5CED0B00BC948DC0C1F0E8C5C4BDF9706566141C71C5B29FD51DA26FC0

HistoryMar 29, 2024 - 10:40 a.m.

Security Bulletin: Vulnerability in GitPython affects IBM Process Mining CVE-2024-22190

2024-03-2910:40:41

www.ibm.com

gitpython

remote attacker

arbitrary code execution

ibm process mining

vulnerability

cve-2024-22190

security fix

open source library

redhat openshift

upgrade

installation

passportadvantage

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

19.7%

JSON

Summary

There is a vulnerability in GitPython that could allow an remote attacker to execute arbitrary code on the system,. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability.

Vulnerability Details

CVEID:CVE-2024-22190
**DESCRIPTION:**GitPython could allow a remote attacker to execute arbitrary code on the system, caused by an untrusted search path flaw. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279354 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Process Mining

1.14.2, 1.14.2 IF001, 1.14.3, 1.14.3 IF001

Remediation/Fixes

Any open source library may be included in one or more sub-components of IBM Process Mining. Open source updates are not always synchronized across all components. The CVE in this bulletin are specifically addressed by

Product(s)	Version(s) number and/or range	Remediation/Fix/Instructions
IBM Process Mining on RedHat OpenShift

1.14.2, 1.14.2 IF001, 1.14.3, 1.14.3 IF001

| **Install/Upgrade to version 1.14.4

Installing a Production deployment
1.**To deploy a Production deployment, see installing on
RedHat OpenShift Container Platform environments

**Upgrading an Installation **** **1.To perform an upgrade of a Production deployment, see
upgrading in RedHat OpenShift Container Platform
environments
IBM Process Mining traditional|

1.14.2, 1.14.3

| **Install/Upgrade to version 1.14.4

** 1.Login to PassPortAdvantage
2.Search for
M0HJMML Process Mining 1.14.4 Server Multiplatform
Multilingual
3.Download package
4.Follow install instructions
5.Repeat for M0HJNML Process Mining 1.14.4 Client
Windows Multilingual

Workarounds and Mitigations

None known

Affected configurations

Vulners

Node

ibmrobotic_process_automation_as_a_serviceMatch1.14.2

ibmrobotic_process_automation_as_a_serviceMatch001

ibmrobotic_process_automation_as_a_serviceMatch1.14.3

ibmrobotic_process_automation_as_a_serviceMatch001

VendorProductVersionCPE
ibmrobotic_process_automation_as_a_service1.14.2cpe:2.3:a:ibm:robotic_process_automation_as_a_service:1.14.2:*:*:*:*:*:*:*
ibmrobotic_process_automation_as_a_service001cpe:2.3:a:ibm:robotic_process_automation_as_a_service:001:*:*:*:*:*:*:*
ibmrobotic_process_automation_as_a_service1.14.3cpe:2.3:a:ibm:robotic_process_automation_as_a_service:1.14.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	robotic_process_automation_as_a_service	1.14.2	cpe:2.3:a:ibm:robotic_process_automation_as_a_service:1.14.2:::::::*
ibm	robotic_process_automation_as_a_service	001	cpe:2.3:a:ibm:robotic_process_automation_as_a_service:001:::::::*
ibm	robotic_process_automation_as_a_service	1.14.3	cpe:2.3:a:ibm:robotic_process_automation_as_a_service:1.14.3:::::::*