Lucene search

K
ibmIBMEA1A632A9BFA31754EDF8B00270F3EA1AE6B629746257F54F7989EC9D2BC3478
HistoryMay 09, 2024 - 12:34 p.m.

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to C-ares (CVE-2024-25629)

2024-05-0912:34:25
www.ibm.com
7
ibm app connect enterprise
c-ares
denial of service
vulnerability
fix pack
it46027

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

Summary

The OpenTelemetry tracing in IBM App Connect Enterprise is vulnerable to a denial of service due to C-ares. This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2024-25629
**DESCRIPTION:**C-ares is vulnerable to a denial of service, caused by an out-of-bounds read in ares__read_line(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 4.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/283978 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM App Connect Enterprise

12.0.7.0 - 12.0.11.3

Remediation/Fixes

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise

Affected Product(s)

|

Version(s)

|

APAR

|

Remediation / Fixes

—|—|—|—

IBM App Connect Enterprise

|

12.0.7.0 - 12.0.11.3

| IT46027|

The APAR (IT46027) is available from

IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.0

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmapp_connect_enterpriseRange12.0.7.0
OR
ibmapp_connect_enterpriseRange12.0.11.3

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%