Security Bulletin: IBM Operational Decision Manager for March 2024 - Multiple CVEs addressed

Summary

IBM Operational Decision Manager is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed.

Vulnerability Details

CVEID:CVE-2007-4559
**DESCRIPTION:**Python could allow a remote attacker to traverse directories on the system, caused by a vulnerability in the tarfile module. By persuading a victim to open a specially-crafted .TAR file containing “dot dot” sequences (/…/) in the filename, a remote attacker could exploit this vulnerability to overwrite arbitrary files on the system with the victim’s privileges.
CVSS Base score: 7.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/36366 for the current score.
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:C/A:N)

CVEID:CVE-2023-44487
**DESCRIPTION:**Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending numerous HTTP/2 requests and RST_STREAM frames over multiple streams, a remote attacker could exploit this vulnerability to cause a denial of service due to server resource consumption.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268044 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-50291
**DESCRIPTION:**Apache Solr could allow a remote authenticated attacker to obtain sensitive information, caused by system property redaction logic inconsistencies. By using the /admin/info/properties endpoint, an attacker could exploit his vulnerability to leak certain passwords.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282740 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2023-50292
**DESCRIPTION:**Apache Solr could allow a remote attacker to execute arbitrary code on the system, caused by the Schema Designer blindly trusting all configsets. An attacker could exploit his vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282739 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2023-50298
**DESCRIPTION:**Apache Solr could allow a remote attacker to obtain sensitive information, caused by an exposure of sensitive information to an unauthorized actor vulnerability. By using Streaming Expressions, an attacker could exploit his vulnerability to extract data from other Solr Clouds using a zkHost parameter and expose ZooKeeper credentials.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282738 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2023-50386
**DESCRIPTION:**Apache Solr could allow a remote attacker to upload arbitrary files, caused by the improper control of dynamically-managed code resources. By using Backup/Restore APIs, a remote attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the vulnerable system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282737 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2023-1932
**DESCRIPTION:**Hibernate Validator is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/282747 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID:CVE-2023-35116
**DESCRIPTION:**Fasterxml jackson-databind is vulnerable to a denial of service, caused by a stack-based overflow. By persuading a victim to open a specially crafted content, a remote attacker could exploit this vulnerability to cause a denial of service. Note: The vendor disputes the vulnerability because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/258157 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM Operational Decision Manager V8.10.4:
Upgrade to IBM Operational Decision Manager V8.10.5.1 and install latest iFix from IBM Fix Central:.

IBM Operational Decision Manager V8.10.5.1:
Interim fix 054 is available from IBM Fix Central:

• 8.10.5.1-WS-ODM_K8S-PPC64LE-IF054
• 8.10.5.1-WS-ODM_K8S-LIN_X86-IF054
• 8.10.5.1-WS-ODM_DS-IF054
• 8.10.5.1-WS-ODM_DC-IF054

IBM Operational Decision Manager V8.11.0.1:
Interim fix 029 is available from IBM Fix Central:

• 8.11.0.1-WS-ODM-IF029
• 8.11.0.1-WS-ODM_K8S-PPC64LE-IF029
• 8.11.0.1-WS-ODM_K8S-LIN_S390-IF029
• 8.11.0.1-WS-ODM_K8S-LIN_X86-IF029

IBM Operational Decision Manager V8.11.1:
Interim fix 021 is available:

• 8.11.1.0-WS-ODM-IF021:
  • IBM Fix Central Download link
• ODM Chart 22.2.21 based on ODM 8.11.1.0-IF021
  • ibm-odm-prod-22.2.21.tgz Helm Chart Download link
  • ibm-odm-prod-1.5.21 CASE Download link

IBM Operational Decision Manager V8.12.0.1:
Interim fix 003 is available:

• 8.12.0.1-WS-ODM-IF003:
  • IBM Fix Central Download link
• ODM Chart 23.2.3 based on ODM 8.12.0.1-IF003
  • 3ibm-odm-prod-23.2.3.tgz Helm Chart Download link
  • ibm-odm-prod-1.7.3 CASE Download link

Workarounds and Mitigations

None