Lucene search

IBMD60E6BA4F6489F1D1F13EB279E6C70998E2F8B1E11393639432A7166F8889E62

HistoryMar 12, 2024 - 5:45 p.m.

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to SnakeYAML (CVE-2022-38752)

2024-03-1217:45:52

www.ibm.com

ibm sterling partner engagement manager

snakeyaml

denial of service

cve-2022-38752

vulnerability

stack-overflow

parsing yaml files

ibm support

upgrade

fix.

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

7.2

Confidence

High

EPSS

0.003

Percentile

69.6%

JSON

Summary

IBM Sterling Partner Engagement Manager uses SnakeYAML.

Vulnerability Details

**CVEID:**CVE-2022-38752 DESCRIPTION: SnakeYAML is vulnerable to a denial of service, caused by a stack-overflow in parsing YAML files. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235310 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Sterling Partner Engagement Manager	6.2.2
IBM Sterling Partner Engagement Manager	6.1.2
IBM Sterling Partner Engagement Manager	6.2.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading …

Product	Version(s)	Remediation
IBM Sterling Partner Engagement Manager Essentials Edition	6.2.2.2	IBM Support: Fix Central - Download files using HTTPS
IBM Sterling Partner Engagement Manager Standard Edition	6.2.2.2	IBM Support: Fix Central - Download files using HTTPS
IBM Sterling Partner Engagement Manager Essentials Edition	6.1.2.9	IBM Support: Fix Central - Download files using HTTPS
IBM Sterling Partner Engagement Manager Standard Edition	6.1.2.9	IBM Support: Fix Central - Download files using HTTPS
IBM Sterling Partner Engagement Manager Essentials Edition	6.2.0.7	IBM Support: Fix Central - Download files using HTTPS
IBM Sterling Partner Engagement Manager Standard Edition	6.2.0.7	IBM Support: Fix Central - Download files using HTTPS

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmulti-enterprise_relationship_managementMatch6.2.2.2

ibmmulti-enterprise_relationship_managementMatch6.1.2.9

ibmmulti-enterprise_relationship_managementMatch6.2.0.7

VendorProductVersionCPE
ibmmulti-enterprise_relationship_management6.2.2.2cpe:2.3:a:ibm:multi-enterprise_relationship_management:6.2.2.2:*:*:*:*:*:*:*
ibmmulti-enterprise_relationship_management6.1.2.9cpe:2.3:a:ibm:multi-enterprise_relationship_management:6.1.2.9:*:*:*:*:*:*:*
ibmmulti-enterprise_relationship_management6.2.0.7cpe:2.3:a:ibm:multi-enterprise_relationship_management:6.2.0.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	multi-enterprise_relationship_management	6.2.2.2	cpe:2.3:a:ibm:multi-enterprise_relationship_management:6.2.2.2:::::::*
ibm	multi-enterprise_relationship_management	6.1.2.9	cpe:2.3:a:ibm:multi-enterprise_relationship_management:6.1.2.9:::::::*
ibm	multi-enterprise_relationship_management	6.2.0.7	cpe:2.3:a:ibm:multi-enterprise_relationship_management:6.2.0.7:::::::*