Lucene search

K
ibmIBME4E5A211CDC3C9F70171F6302E9DC92BD84CCBD8E64BC3B6009DBDD87DB2F0D5
HistoryMay 08, 2024 - 6:03 a.m.

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to a denial of service (CVE-2024-27268)

2024-05-0806:03:27
www.ibm.com
4
ibm
engineering lifecycle
websphere
denial of service
vulnerability
security bulletin
http/2
protocol
affected products
fix pack
apar ph60146
interim fix
mitigation

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

Summary

IBM WebSphere Application Server Liberty is vulnerable to a denial of service with the servlet-3.1, servlet-4.0, servlet-5.0, or servlet-6.0 feature with the HTTP/2 protocol enabled. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this risk, it has been addressed in this bulletin: Jazz Foundation, IBM Engineering Test Management, IBM Engineering Workflow Management, Global Configuration Management, IBM Engineering Requirements Management DOORS Next.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) Version(s)
IBM Engineering Workflow Management 7.0.2
Global Configuration Management
IBM Engineering Test Management
IBM Engineering Requirements Management DOORS Next
Jazz Foundation
IBM Engineering Workflow Management 7.0.3
Global Configuration Management
IBM Engineering Test Management
IBM Engineering Requirements Management DOORS Next
Jazz Foundation

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH60146.

If any of the mentioned affected product is deployed on one of the above versions, Please follow the instruction given in the following article.

Link: <https://www.ibm.com/support/pages/node/7145809&gt;

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmengineering_lifecycle_managementMatch7.0.2
OR
ibmengineering_lifecycle_managementMatch7.0.3

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

Related for E4E5A211CDC3C9F70171F6302E9DC92BD84CCBD8E64BC3B6009DBDD87DB2F0D5