Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM92E43EED165E4E31D7D40C9215CBB681AFD4744E6384CB62D7CD86B9AF0E6D9C
HistoryJun 25, 2024 - 10:08 p.m.

Security Bulletin: Maximo Application Suite - Multiple Netty package is vulnerable to CVE-2024-29025 used in IBM Maximo Application Suite - Monitor Component

2024-06-2522:08:07
www.ibm.com
3
ibm maximo application suite
monitor component
netty
cve-2024-29025
denial of service
update available

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Summary

IBM Maximo Application Suite - Monitor Component uses multiple Netty package which is vulnerable to CVE-2024-29025. This bulletin identifies the steps to take to address the vulnerabilities.

Vulnerability Details

CVEID:CVE-2024-29025
**DESCRIPTION:**Netty is vulnerable to a denial of service, caused by a flaw when using the HttpPostRequestDecoder to decode a form. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/286403 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Maximo Application Suite - Monitor Component 8.11
IBM Maximo Application Suite - Monitor Component 8.10

Remediation/Fixes

Affected Product(s) Fixpack Version(s)
IBM Maximo Application Suite - Monitor Component 8.11.7 or latest (available from the Catalog under Update Available)
IBM Maximo Application Suite - Monitor Component 8.10.10 or latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmmaximo_application_suiteMatch8.11
OR
ibmmaximo_application_suiteMatch8.10

Related

ubuntucve 1
cvelist 1
nessus 3
ibm 12
veracode 1
debiancve 1
osv 3
nvd 1
openvas 1
cve 1
redhatcve 1
cgr 1
wolfi 1
github 1
redhat 8
redos 1
ubuntucve
ubuntucve
CVE-2024-29025
2024-03-25 00:00:00
cvelist
cvelist
CVE-2024-29025 Netty HttpPostRequestDecoder can OOM
2024-03-25 20:09:35
nessus
nessus
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : netty, netty-tcnative (SUSE-SU-2024:1079-1)
2024-04-03 00:00:00
Debian dla-3834 : libnetty-java - security update
2024-06-22 00:00:00
RHEL 6 : netty-codec-http (Unpatched Vulnerability)
2024-06-22 00:00:00
ibm
ibm
Security Bulletin: A vulnerability in Transparent Cloud Tiering affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products
2024-06-19 10:43:36
Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in the open source netty-codec-http library. (CVE-2024-29025)
2024-06-11 17:35:37
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Denial of Service Vulnerability in Netty (CVE-2024-29025)
2024-05-20 14:44:49
veracode
veracode
Denial Of Service (DoS)
2024-03-28 03:09:13
debiancve
debiancve
CVE-2024-29025
2024-03-25 20:15:08
osv
osv
Netty's HttpPostRequestDecoder can OOM
2024-03-25 19:40:50
CGA-mgv4-g226-vxr2
2024-06-19 07:37:01
CVE-2024-29025
2024-03-25 20:15:08
nvd
nvd
CVE-2024-29025
2024-03-25 20:15:08
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2024:1079-1)
2024-05-07 00:00:00
cve
cve
CVE-2024-29025
2024-03-25 20:15:08
redhatcve
redhatcve
CVE-2024-29025
2024-04-03 12:18:09
cgr
cgr
CVE-2024-29025 vulnerabilities
2024-05-19 03:07:16
wolfi
wolfi
CVE-2024-29025 vulnerabilities
2024-06-28 21:08:33
github
github
Netty's HttpPostRequestDecoder can OOM
2024-03-25 19:40:50
redhat
redhat
(RHSA-2024:2705) Moderate: Red Hat build of Quarkus 3.2.12 release and security update
2024-05-09 11:54:42
(RHSA-2024:2106) Moderate: Red Hat build of Quarkus 3.8.4 release
2024-05-07 16:19:27
(RHSA-2024:2834) Important: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.4.SP1)
2024-05-16 13:51:15
redos
redos
ROS-20240514-04
2024-05-14 00:00:00

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON
Related for 92E43EED165E4E31D7D40C9215CBB681AFD4744E6384CB62D7CD86B9AF0E6D9C
ubuntucve1cvelist1nessus3ibm12veracode1debiancve1osv3nvd1openvas1cve1redhatcve1cgr1wolfi1github1redhat8redos1