Security Bulletin: IBM Observability with Instana using third-party Kubernetes Operators is affected by Multiple Security Vulnerabilities

Summary

Multiple vulnerabilities were remediated in IBM Observability with Instana using third-party Kubernetes Operators build 271.

Vulnerability Details

CVEID:CVE-2024-1023
**DESCRIPTION:**Eclipse Vert.x is vulnerable to a denial of service, caused by a memory leak due to the use of Netty FastThreadLocal data structures. By persuading to open a specially crafted content, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282748 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

CVEID:CVE-2024-23944
**DESCRIPTION:**Apache ZooKeeper could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in persistent watchers handling. By attaching a persistent watcher to a parent, an attacker could exploit this vulnerability to obtain information of the full path of znodes, and use this information to launch further attacks against the affected system.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/285579 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-45146
**DESCRIPTION:**The Legion of the Bouncy Castle BC-FJA could allow a remote attacker to obtain sensitive information, caused by an issue with the temporary keys used by the BC-FJA FIPS module to be zeroed out while still in use by the module. By persuading a victim to open a specially-crafted content, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/240854 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

CVEID:CVE-2024-1300
**DESCRIPTION:**Eclipse Vert.x is vulnerable to a denial of service, caused by a memory leak when a TCP server is configured with TLS and SNI support. By sending a specially crafted TLS client hello message, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282749 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:

<https://www.ibm.com/docs/en/instana-observability/current?topic=stores-using-kubernetes-operators&gt;

Workarounds and Mitigations

None