Lucene search

K
ibmIBM96F821EBABF4AC9F79F28A552BB4EE4403A41B197EA039253556E50575F61534
HistoryJun 28, 2023 - 8:41 p.m.

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in WavPack ( CVE-2021-44269)

2023-06-2820:41:09
www.ibm.com
9
ibm watson
speech services
cartridge
cloud pak
data
vulnerability
denial of service
wavpack
cve-2021-44269
out-of-bounds read
remediation
upgrade
4.7
download
install

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

49.0%

Summary

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in WavPack, caused by a heap out-of-bounds read flaw in WavpackPackSamples function in src/pack_utils.c ( CVE-2021-44269). WavPack is included as part of the runtimes in our service. This vulnerabilitiy has been addressed. Please read the details for remediation below.

Vulnerability Details

CVEID:CVE-2021-44269
**DESCRIPTION:**WavPack is vulnerable to a denial of service, caused by a heap out-of-bounds read flaw in WavpackPackSamples function in src/pack_utils.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221610 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 - 4.6.6

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading.

Product(s)|**Version(s)
**|Remediation/Fix/Instructions
—|—|—
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data| 4.7| The fix in 4.7 applies to all versions listed (4.0.0-4.6.6). Version 4.7 can be downloaded and installed from: <https://www.ibm.com/docs/en/cloud-paks/cp-data&gt;

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmspeech_to_textMatch4.0.0
OR
ibmspeech_to_textMatch4.6.6

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

49.0%