Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM8FAAE821E57D7271E920205BFCAED001A2410BAD7F9312890DDA7316CF34F0BA
HistoryNov 15, 2023 - 6:12 p.m.

Security Bulletin: IBM Integration Bus is vulnerable to a denial of service due to Eclipse Jetty. (CVE-2023-36478)

2023-11-1518:12:56
www.ibm.com
24
ibm integration bus
eclipse jetty
denial of service
cve-2023-36478
vulnerability
fix
it44857

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.005

Percentile

76.5%

JSON

Summary

IBM Integration Bus runtime and toolkit are vulnerable to a denial of service due to Eclipse Jetty. (CVE-2023-36478)

Vulnerability Details

CVEID:CVE-2023-36478
**DESCRIPTION:**Eclipse Jetty is vulnerable to a denial of service, caused by an integer overflow and buffer allocation in MetaDataBuilder.checkSize. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268413 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Integration Bus 10.1 - 10.1.0.2

Remediation/Fixes

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM Integration Bus

Affected Product(s) Version(s) APAR Remediation / Fix
IBM Integration Bus 10.1 - 10.1.0.2 IT44857 Interim Fix for APAR (IT44857) is available to apply to 10.1.0.2 from

IBM Fix Central

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmintegration_busRange10.1≥
OR
ibmintegration_busRange≤10.1.0.2
VendorProductVersionCPE
ibmintegration_bus*cpe:2.3:a:ibm:integration_bus:*:*:*:*:*:*:*:*

Related

prion 1
ibm 34
openvas 6
redhatcve 1
cvelist 1
osv 6
alpinelinux 1
atlassian 3
ubuntucve 1
debiancve 1
nvd 1
redos 1
nessus 7
cve 1
github 1
veracode 1
debian 2
freebsd 1
redhat 2
oracle 3
prion
prion
Integer overflow
2023-10-10 17:15:00
ibm
ibm
Security Bulletin: IBM InfoSphere Information Server is affected by Eclipse Jetty vulnerability (CVE-2023-36478)
2023-11-29 04:47:05
Security Bulletin: IBM Event Streams is vulnerable to a denial of service due to the Eclipse Jetty component (CVE-2023-36478).
2024-03-15 06:24:51
Security Bulletin: Vulnerability in Eclipse Jetty affects IBM watsonx.data
2024-09-25 19:03:57
openvas
openvas
Eclipse Jetty HTTP/2 HPACK DoS Vulnerability (GHSA-wgh7-54f2-x98r) - Windows
2023-10-12 00:00:00
Eclipse Jetty HTTP/2 HPACK DoS Vulnerability (GHSA-wgh7-54f2-x98r) - Linux
2023-10-12 00:00:00
Debian: Security Advisory (DSA-5540-1)
2023-10-31 00:00:00
redhatcve
redhatcve
CVE-2023-36478
2023-10-11 10:42:39
cvelist
cvelist
CVE-2023-36478 HTTP/2 HPACK integer overflow and buffer allocation
2023-10-10 16:53:07
osv
osv
BIT-jenkins-2023-36478
2024-03-06 10:55:21
BIT-2023-36478
2023-10-28 06:19:55
HTTP/2 HPACK integer overflow and buffer allocation
2023-10-10 21:16:23
alpinelinux
alpinelinux
CVE-2023-36478
2023-10-10 17:15:11
atlassian
atlassian
DoS (Denial of Service) org.eclipse.jetty:jetty-http Dependency in Bitbucket Data Center and Server
2023-12-14 07:45:23
DoS (Denial of Service) org.eclipse.jetty:jetty-http Dependency in Bamboo Data Center and Server
2023-12-19 10:45:37
DoS (Denial of Service) org.eclipse.jetty:jetty-http Dependency in Confluence Data Center and Server
2024-03-07 02:45:51
ubuntucve
ubuntucve
CVE-2023-36478
2023-10-10 00:00:00
debiancve
debiancve
CVE-2023-36478
2023-10-10 17:15:11
nvd
nvd
CVE-2023-36478
2023-10-10 17:15:11
redos
redos
ROS-20240729-12
2024-07-29 00:00:00
nessus
nessus
Atlassian Confluence < 7.19.20 / 7.20.x < 8.5.7 (CONFSERVER-94843)
2024-03-29 00:00:00
FreeBSD : jenkins -- HTTP/2 denial of service vulnerability in bundled Jetty (1ee26d45-6ddb-11ee-9898-00e081b7aa2d)
2023-10-18 00:00:00
Jenkins LTS < 2.414.3 / Jenkins weekly < 2.428 Multiple Vulnerabilities
2023-10-18 00:00:00
cve
cve
CVE-2023-36478
2023-10-10 17:15:11
github
github
HTTP/2 HPACK integer overflow and buffer allocation
2023-10-10 21:16:23
veracode
veracode
Denial Of Service (DoS)
2023-10-12 05:13:43
debian
debian
[SECURITY] [DSA 5540-1] jetty9 security update
2023-10-30 19:52:02
[SECURITY] [DLA 3641-1] jetty9 security update
2023-10-30 20:10:54
freebsd
freebsd
jenkins -- HTTP/2 denial of service vulnerability in bundled Jetty
2023-10-18 00:00:00
redhat
redhat
(RHSA-2023:7247) Critical: Red Hat Fuse 7.12.1 release and security update
2023-11-15 17:06:12
(RHSA-2024:3354) Important: Red Hat Fuse 7.13.0 release and security update
2024-05-23 22:44:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.005

Percentile

76.5%

JSON
Related for 8FAAE821E57D7271E920205BFCAED001A2410BAD7F9312890DDA7316CF34F0BA
prion1ibm34openvas6redhatcve1cvelist1osv6alpinelinux1atlassian3ubuntucve1debiancve1nvd1redos1nessus7cve1github1veracode1debian2freebsd1redhat2oracle3