Lucene search

IBME680F8E3644CA1D4B12047C64476D3FC28674312C1A463EDD0ED7AFD1F79593C

HistorySep 10, 2024 - 6:44 p.m.

Security Bulletin: IBM InfoSphere Information Server is affected by a denial of service vulnerability in Undertow (CVE-2024-6162)

2024-09-1018:44:38

www.ibm.com

ibm infosphere information server

denial of service

vulnerability

undertow

cve-2024-6162

infosphere information server 11.7

fix

patch

security bulletin

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

JSON

Summary

A denial of service vulnerability in Undertow that is used by InfoSphere Information Server was addressed.

Vulnerability Details

CVEID:CVE-2024-6162
**DESCRIPTION:**Undertow is vulnerable to a denial of service, caused by a flaw with URL-encoded request path information can be broken for concurrent requests on ajp-listener. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/295439 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
InfoSphere Information Server	11.7

Remediation/Fixes

Product	VRMF	APAR	Remediation
InfoSphere Information Server, InfoSphere Information Server on Cloud	11.7	DT390942	--Apply IBM InfoSphere Information Server version 11.7.1.0
--Apply InfoSphere Information Server version 11.7.1.5
--Apply InfoSphere Information Server Microservices tier rollup patch

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibminfosphere_information_serverMatch11.7

VendorProductVersionCPE
ibminfosphere_information_server11.7cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	infosphere_information_server	11.7	cpe:2.3:a:ibm:infosphere_information_server:11.7:::::::*

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

JSON

Related for E680F8E3644CA1D4B12047C64476D3FC28674312C1A463EDD0ED7AFD1F79593C