Security Bulletin: Denial of service and server-side request forgery might affect IBM Storage Defender – Resiliency Service

Summary

IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2024-39249, CVE-2024-39338

Vulnerability Details

CVEID:CVE-2024-39249
**DESCRIPTION:**Async is vulnerable to a denial of service, caused by the ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service. Note: This vulnerability is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/297174 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2024-39338
**DESCRIPTION:**Axios is vulnerable to server-side request forgery, caused by a flaw with requests for path relative URLs get processed as protocol relative URLs. By sending a specially crafted request, an attacker could exploit this vulnerability to conduct SSRF attack.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/350874 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

The Connection Manager included with Defender 2.0.7 and newer provides the fixes. If using a version of the Connection Manager obtained from Defender 2.0.0 - 2.0.6, IBM strongly recommends upgrading. Instructions for upgrading can be found here.

Workarounds and Mitigations

None