CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low
EPSS
Percentile
93.0%
Vulnerabilities in libmaxminddb, dnsmasq and bind affect IBM Storage Virtualize products and could cause impacts to integrity and availability. CVE-2023-50387 CVE-2023-50868 CVE-2020-28241 CVE-2023-4408.
CVEID:CVE-2023-50387
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an error when processing responses coming from specially crafted DNSSEC-signed zones. By flooding the target server with queries, a remote attacker could exploit this vulnerability to cause CPU exhaustion on a DNSSEC-validating resolver.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/281081 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2023-50868
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an error when preparing an NSEC3 closest encloser proof. By flooding the target resolver with queries, a remote attacker could exploit this vulnerability to cause CPU exhaustion on a DNSSEC-validating resolver.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282901 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2020-28241
**DESCRIPTION:**Libmaxminddb is vulnerable to a heap-based buffer overflow, caused by improper bounds checking in dump_entry_data_list in maxminddb.c. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/191345 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVEID:CVE-2023-4408
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an error when parsing large DNS messages. By flooding the target server with queries, a remote attacker could exploit this vulnerability to cause excessive CPU load.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282906 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM Storage Virtualize | 8.4 |
IBM Storage Virtualize | 8.5 |
IBM Storage Virtualize | 8.6 |
IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, IBM Storwize V5000 and V5100, IBM Storwize V5000E, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud, IBM FlashSystem V9000, IBM FlashSystem 9500, IBM FlashSystem 9100 Family, IBM FlashSystem 9200, IBM FlashSystem 7300, IBM FlashSystem 7200, IBM FlashSystem 5200 and IBM FlashSystem 5000 to the following code levels or higher:
8.4.0.15
8.5.0.13
8.6.0.5
8.7.0.0
Latest IBM SAN Volume Controller Code
Latest IBM Storwize V7000 Code
Latest IBM Storwize V5000 and V5100 Code
Latest IBM Storwize V5000E Code
Latest IBM FlashSystem V9000 Code
Latest IBM FlashSystem 9500 Code
Latest IBM FlashSystem 9100 Family Code
Latest IBM FlashSystem 9200 Code
Latest IBM FlashSystem 7300 Code
Latest IBM FlashSystem 7200 Code
Latest IBM FlashSystem 5000 and 5200 Code
Latest IBM Spectrum Virtualize Software
Latest IBM Spectrum Virtualize for Public Cloud
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | ibm_flashsystem_5x00 | 8.4 | cpe:2.3:a:ibm:ibm_flashsystem_5x00:8.4:*:*:*:*:*:*:* |
ibm | ibm_flashsystem_5x00 | 8.5 | cpe:2.3:a:ibm:ibm_flashsystem_5x00:8.5:*:*:*:*:*:*:* |
ibm | ibm_flashsystem_5x00 | 8.6 | cpe:2.3:a:ibm:ibm_flashsystem_5x00:8.6:*:*:*:*:*:*:* |
ibm | storwize_v5000 | 8.4 | cpe:2.3:h:ibm:storwize_v5000:8.4:*:*:*:*:*:*:* |
ibm | storwize_v5000 | 8.5 | cpe:2.3:h:ibm:storwize_v5000:8.5:*:*:*:*:*:*:* |
ibm | storwize_v5000 | 8.6 | cpe:2.3:h:ibm:storwize_v5000:8.6:*:*:*:*:*:*:* |
ibm | spectrum_virtualize_for_public_cloud | 8.4 | cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:8.4:*:*:*:*:*:*:* |
ibm | spectrum_virtualize_for_public_cloud | 8.5 | cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:8.5:*:*:*:*:*:*:* |
ibm | spectrum_virtualize_for_public_cloud | 8.6 | cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:8.6:*:*:*:*:*:*:* |
ibm | ibm_flashsystem_9x00 | 8.4 | cpe:2.3:a:ibm:ibm_flashsystem_9x00:8.4:*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low
EPSS
Percentile
93.0%