Security Bulletin: Vulnerabilities in Java and IBM WebSphere Application Server Liberty affects IBM Cloud Application Business Insights - CVE-2022-41946 & CVE-2023-24998

Summary

Vulnerabilities in Java and IBM WebSphere Application Server Liberty affects IBM Cloud Application Business Insights CVE-2022-41946 & CVE-2023-24998

Vulnerability Details

CVEID:CVE-2023-24998
**DESCRIPTION:**Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By sending a specially-crafted request with series of uploads, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/247895 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

For systems where IBM Cloud Application Business Insights version 1.1.7 is installed, the vulnerabilities can be remediated by applying the ICABI FixPack 1.1.7.7.

For systems where IBM Cloud Application Business Insights version 1.1.8 is installed, the vulnerabilities can be remediated by applying the ICABI FixPack 1.1.8.1.

ICABI 1.1.7 Fix Pack 7 - <https://www.ibm.com/docs/en/cabi/1.1.7?topic=summary-whats-new-in-fix-pack-7&gt;

ICABI 1.1.8 Fix Pack 1 - <https://www.ibm.com/docs/en/cabi/1.1.8?topic=summary-whats-new-in-fix-pack-1&gt;

The fixes and install instructions can be found at the following location:

Workarounds and Mitigations

None