Lucene search
IBME0E1D996E2538457D3137D56EB0BB1D46D9CFEA24E8563C06C9EF1CA97CD1F62HistoryJul 14, 2023 - 10:12 p.m.
Security Bulletin: IBM InfoSphere Information Server is affected by a denial of service vulnerability in netplex json-smart-v2 (CVE-2023-1370)
2023-07-1422:12:37
www.ibm.com
27
0.001 Low
EPSS
Percentile
39.6%
Summary
A denial of service vulnerability in netplex json-smart-v2 used by InfoSphere Information Server was addressed.
Vulnerability Details
CVEID:CVE-2023-1370
**DESCRIPTION:**netplex json-smart-v2 is vulnerable to a denial of service, caused by not limiting the nesting of arrays or objects. By sending a specially crafted input, a remote attacker could exploit this vulnerability to cause a stack exhaustion and crash the software.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/249885 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| InfoSphere Information Server | 11.7 |
Remediation/Fixes
| Product | VRMF | APAR | Remediation |
|---|---|---|---|
| InfoSphere Information Server, InfoSphere Information Server on Cloud | 11.7 | DT209601 | --Apply IBM InfoSphere Information Server version 11.7.1.0 |
| --Apply InfoSphere Information Server version 11.7.1.4 | |||
| --Apply InfoSphere Information Server 11.7.1.4 Service pack 1 | |||
| --Apply Information Server Microservices tier security patch | |||
| --Apply SQL Server JDBC driver security patch for Information Server |
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm infosphere information server | eq | 11.7 |
Related
cvelist
cvelist
atlassian
atlassian
ibm
ibm
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to netplex json-smart-v2 denial of service vulnerability( CVE-2023-1370)
2023-07-06 18:05:47
ubuntucve
ubuntucve
CVE-2023-1370
2023-03-22 00:00:00
nessus
nessus
redhat
redhat
cgr
cgr
CVE-2023-1370 vulnerabilities
2024-05-19 03:07:16
veracode
veracode
Denial Of Service (DoS)
2023-03-24 05:47:33
debiancve
debiancve
CVE-2023-1370
2023-03-22 06:15:09
osv
osv
Karate has vulnerable dependency on json-smart package (CVE-2023-1370)
2023-03-31 22:44:09
CVE-2023-1370
2023-03-22 06:15:09
json-smart Uncontrolled Recursion vulnerabilty
2023-03-23 20:32:03
prion
prion
Stack overflow
2023-03-22 06:15:00
github
github
Karate has vulnerable dependency on json-smart package (CVE-2023-1370)
2023-03-31 22:44:09
json-smart Uncontrolled Recursion vulnerabilty
2023-03-23 20:32:03
cve
cve
CVE-2023-1370
2023-03-22 06:15:09
redhatcve
redhatcve
CVE-2023-1370
2023-04-21 05:56:49
openvas
openvas
Ubuntu: Security Advisory (USN-6011-1)
2023-04-13 00:00:00
Debian: Security Advisory (DLA-3373-1)
2023-03-31 00:00:00
ubuntu
ubuntu
Json-smart vulnerabilities
2023-04-12 00:00:00
debian
debian
[SECURITY] [DLA 3373-1] json-smart security update
2023-03-31 08:03:30
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00
0.001 Low
EPSS
Percentile
39.6%
Related for E0E1D996E2538457D3137D56EB0BB1D46D9CFEA24E8563C06C9EF1CA97CD1F62