IBMEA9BBDE42F62D694DFAC30E0A60158FD3093956B4C5DBB254A88FA4BA46B08D0Security Bulletin: junrar v7.4.0 and prior Denial of Service (DoS) security vulnerability in IBM FileNet Content Manager Content Search Services (CSS)
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
55.6%
Summary
junrar v7.4.0 and prior Denial of Service (DoS) security vulnerability in IBM FileNet Content Manager Content Search Services (CSS). A carefully crafted RAR archive can trigger an infinite loop while parsing the file. This could be used to mount a denial of service attack against services that use junrar.
Vulnerability Details
CVEID:CVE-2022-23596
**DESCRIPTION:**Junrar is vulnerable to a denial of service, caused by an infinite loop when extracting RAR files. By persuading a victim to open a specially-crafted RAR file, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/218764 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Enterprise Content Management Text Search | 5.5.4.0 |
| IBM Enterprise Content Management Text Search | 5.5.7.0 |
| IBM Enterprise Content Management Text Search | 5.5.8.0 |
Remediation/Fixes
o resolve these vulnerabilities, install one of the patch sets listed below to upgrade junrar.
| Product | VRMF | APAR | Remediation/First Fix |
|---|---|---|---|
| FileNet Content Manager |
5.5.4
5.5.7
5.5.8
| PJ46715
PJ46715
PJ46715| 5.5.4.0-P8CSS-IF008 - 5/24/2022
5.5.7.0-P8CSS-IF003 - 6/29/2022
5.5.8.0-P8CSS-IF001 - 3/22/2022
In the above table, the APAR links will provide more information about the fix.
Workarounds and Mitigations
Disable indexing of RAR files
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | filenet_content_manager | 5.5.4 | cpe:2.3:a:ibm:filenet_content_manager:5.5.4:*:*:*:*:*:*:* |
| ibm | filenet_content_manager | 5.5.7 | cpe:2.3:a:ibm:filenet_content_manager:5.5.7:*:*:*:*:*:*:* |
| ibm | filenet_content_manager | 5.5.8 | cpe:2.3:a:ibm:filenet_content_manager:5.5.8:*:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
55.6%