Security Bulletin: Due to the use of Golang Go, IBM Workload Scheduler is vulnerable to a denial of service.

Summary

Gloang Go is used by IBM Workload Scheduler CVE-2022-41717

Vulnerability Details

CVEID:CVE-2022-41717
**DESCRIPTION:**Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in the Go server. By sending a specially-crafted keys, a remote attacker could exploit this vulnerability to cause excessive memory growth, and results in a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241875 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

APAR IJ48273 has been opened to address the vulnerability in Go affecting IBM Workload Scheduler.
APAR IJ48273 is included in IBM Workload Scheduler 10.1.0.3, available on Fix Central.

Workarounds and Mitigations

None