Lucene search

IBMFC9948167B9BA747EA8FF96864B5EC5A5579725E20B271870DEDDCE0543C5058

HistorySep 10, 2024 - 5:21 a.m.

Security Bulletin: IBM Automation Decision Services for August 2024 - Multiple CVEs addressed

2024-09-1005:21:14

www.ibm.com

ibm automation decision services

vulnerable

remote code execution

denial of service

cve-2024-5321

kubernetes kubelet

security bulletin

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

Confidence

Low

JSON

Summary

IBM Automation Decision Services is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed

Vulnerability Details

CVEID:CVE-2024-5321
**DESCRIPTION:**Kubernetes kubelet could allow a local authenticated attacker to bypass security restrictions, caused by incorrect permissions on Windows containers logs. By sending a specially crafted request, an attacker could exploit this vulnerability to read and modify container logs.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/298140 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Automation Decision Services	24.0.0

Remediation/Fixes

IBM Automation Decision Services 24.0.0:

Interim fix 002 is available:

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmautomation_workstream_servicesMatch24.0.0

VendorProductVersionCPE
ibmautomation_workstream_services24.0.0cpe:2.3:a:ibm:automation_workstream_services:24.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	automation_workstream_services	24.0.0	cpe:2.3:a:ibm:automation_workstream_services:24.0.0:::::::*

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

Confidence

Low

JSON

Related for FC9948167B9BA747EA8FF96864B5EC5A5579725E20B271870DEDDCE0543C5058