Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to YAML denial of service (CVE-2023-2251)

Summary

YAML is used in IBM Decision Optimization in IBM Cloud Pak for Data. IBM Decision Optimization in IBM Cloud Pak for Data has addressed the reported vulnerability.

Vulnerability Details

CVEID:CVE-2023-2251
**DESCRIPTION:**YAML is vulnerable to a denial of service, caused by an uncaught exception in the parseDocument and parseAllDocuments functions. By sending a specially crafted input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253642 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly suggests to upgrade to IBM Decision Optimization in IBM Cloud Pak for Data 4.7 or higher, using the Operator upgrade process described in the IBM Documentation:
<https://www.ibm.com/docs/en/cloud-paks/cp-data/4.7.x?topic=upgrading-from-cloud-pak-data-version-46&gt;

Workarounds and Mitigations

None