Security Bulletin: Vulnerability in Apache Solr, Apache Zookeeper and Logstash affect IBM Operations Analytics - Log Analysis (CVE-2023-34462)

Summary

There is Netty vulnerability in Apache Solr, Apache Zookeeper and Logstash that effect IBM Operations Analytics - Log Analysis. These have been addressed

Vulnerability Details

CVEID:CVE-2023-34462
**DESCRIPTION:**Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS handshake the SniHandler class. By sending a specially crafted client hello packet, a remote authenticated attacker could exploit this vulnerability to cause a OutOfMemoryError and so result in a denial of service condition.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/258713 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Install Log Analysis 1.3.8 and upgrade to Log Analysis version 1.3.8 Fix Pack 1

You can download the release from Passport Advantage. Part number:
M0GJREN IBM Operations Analytics Log Analysis v1.3.8 Linux 64 bit
M0GJSEN IBM Operations Analytics Log Analysis v1.3.8 zLinux 64 bit
M0GJTEN IBM Operations Analytics Log Analysis v1.3.8 Power8 ppc64le

Download the 1.3.8-TIV-IOALA-FP1

Workarounds and Mitigations

None