Lucene search

K
ibmIBMD5283E4112DC10697CF7333C5134EF86B0A5E943A42EBBFECBA0C5A17510C321
HistoryFeb 16, 2022 - 2:19 p.m.

Security Bulletin: Vulnerability in Polkit affects IBM Cloud Pak for Data System 1.0

2022-02-1614:19:29
www.ibm.com
9

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0005 Low

EPSS

Percentile

13.6%

Summary

Polkit is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE (CVE-2021-4034).

Vulnerability Details

CVEID:CVE-2021-4034
**DESCRIPTION:**Polkit could allow a local authenticated attacker to gain elevated privileges on the system, caused by incorrect handling of the argument vectors in the pkexec utility. By crafting environment variables in a specific way, an attacker could exploit this vulnerability to execute commands with root privileges.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/218087 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
CPDS 1.0.0.0- 1.0.7.7

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying below security patch.

Product VRMF Remediation / First Fix
IBM Cloud Pak for Data System 1.0 7.9.22.01.SP9 Link to fix central
  • Please follow the steps given in release notes to upgrade the system with security patches

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm cloud pak for data systemeq1.0

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0005 Low

EPSS

Percentile

13.6%