Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Plugin Framework for Java (PF4J)

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Plugin Framework for Java PF4J. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-40828 DESCRIPTION: Plugin Framework for Java PF4J coul...

Linux Distros Unpatched Vulnerability : CVE-2023-40826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter...

org.pf4j:pf4j-spring (0.5.0) potentially affected by CVE-2023-40826 via org.pf4j:pf4j (2.3.0)

org.pf4j:pf4j MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - org.pf4j:pf4j-spring 0.5.0 Source cves: CVE-2023-40826 Source advisory: OSV:GHSA-3R28-RGP9-QGV4...

care.better.pf4j:pf4j-kotlin-symbol-processing (>=1.0.0-rc1, <=2.0.21-1.0.1), cn.tannn.jdevelops:jdevelops-pf4j-spring-starter (>=0.0.1, <=1.0.3) +564 more potentially affected by CVE-2023-40826 via org.pf4j:pf4j (>=3.0.1, <=3.9.0)

org.pf4j:pf4j MAVEN version =3.0.1, =1.0.0-rc1, =0.0.1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =0.0.4, =3.0.0-m3, =0.0.1, =3.0.0-m3, =1.0.9, =0.0.2, =0.0.1, =0.0.7, =0.0.10, =0.0.13 and more Source cves: CVE-2023-40826 Source advisory: OSV:GHSA-3R28-RGP9-QGV4...

com.bitplan.dragtop:com.bitplan.dragtop (>=0.0.1, <=0.0.2), com.bitplan.pdfextractor:com.bitplan.pdfextractor (0.0.1) +4 more potentially affected by CVE-2023-40826 via org.pf4j:pf4j (2.4.0)

org.pf4j:pf4j MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.bitplan.dragtop:com.bitplan.dragtop =0.0.1, =5.0.0, =5.0.0, =1.0.2.release, =1.0.6.release Source cves: CVE-2023-40826 Source...

org.pf4j:pf4j-spring (0.4.0) potentially affected by CVE-2023-40826 via org.pf4j:pf4j (2.0.0)

org.pf4j:pf4j MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - org.pf4j:pf4j-spring 0.4.0 Source cves: CVE-2023-40826 Source advisory: OSV:GHSA-3R28-RGP9-QGV4...

com.github.vindell:spring-boot-starter-pf4j2 (>=1.0.0.release, <=1.0.1.release), org.pf4j:pf4j-update (>=2.0.0, <=2.1.0) potentially affected by CVE-2023-40826 via org.pf4j:pf4j (2.2.0)

org.pf4j:pf4j MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.github.vindell:spring-boot-starter-pf4j2 =1.0.0.release, =2.0.0, =2.1.0 Source cves: CVE-2023-40826 Source advisory:...

CVE-2023-40826

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter...

CVE-2023-40826

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter...

CVE-2023-40826

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter...

CVE-2023-40826

PF4J (Plugin Framework for Java) v3.9.0 and earlier is affected by CVE-2023-40826, where improper input validation in the zippluginPath handling can allow a remote attacker to obtain sensitive information and execute arbitrary code via a crafted archive. The issue is referenced across multiple fe...