Security Bulletin: Vulnerability in Python affects watsonx.data

2024-09-0517:56:06

www.ibm.com

python

tempfile

vulnerability

watsonx.data

security

exploit

upgrade

ibm

cpd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

6.4

Confidence

Low

JSON

Summary

Python could provide weaker than expected security caused by an issue with tempfile. This can affect watsonx.data.

Vulnerability Details

CVEID:CVE-2023-6597
**DESCRIPTION:**Python could provide weaker than expected security, caused by an issue with tempfile.TemporaryDirectory fails removing dir in some edge cases related to symlinks. A local attacker could exploit this vulnerability to launch further attacks on the system.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/283230 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
watsonx.data	1.0.0 - 1.1.4

Remediation/Fixes

The product needs to be installed or upgraded to the latest available level watsonx.data 2.0.1 or watsonx.data on CPD 5.0.1. Installation/upgrade instructions can be found here: <https://www.ibm.com/docs/en/watsonx/watsonxdata/2.0.x?topic=deployment-installing>.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmibm_watsonx_subscriptionMatch1.1.0

ibmibm_watsonx_subscriptionMatch2.0.0

VendorProductVersionCPE
ibmibm_watsonx_subscription1.1.0cpe:2.3:a:ibm:ibm_watsonx_subscription:1.1.0:*:*:*:*:*:*:*
ibmibm_watsonx_subscription2.0.0cpe:2.3:a:ibm:ibm_watsonx_subscription:2.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	ibm_watsonx_subscription	1.1.0	cpe:2.3:a:ibm:ibm_watsonx_subscription:1.1.0:::::::*
ibm	ibm_watsonx_subscription	2.0.0	cpe:2.3:a:ibm:ibm_watsonx_subscription:2.0.0:::::::*