Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in okio-2.8.0.jar

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of okio-2.8.0.jar Vulnerability Details CVEID:CVE-2023-3635 DESCRIPTION: GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client...

ai.ancf.lmos:lmos-operator (>=0.5.0 <=0.6.0), ai.berktest:BerkClient (>=1.0.0 <=1.0.3) +16308 more potentially affected by CVE-2023-3635 via com.squareup.okio:okio (>=0.6.0 <=1.17.5)

com.squareup.okio:okio MAVEN version =0.6.0, =0.5.0, =1.0.0, =0.80.7, =0.80.7, =0.80.7, =0.80.7, =3.24.0.1, =3.0.1.4, =3.32.0.1-2-2.1, =3.32.0.1-2-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.36.0.2-1-3.1 and more Source cves: CVE-2023-3635 Source advisory:...

ai.agenticants:ants-platform-java (>=0.1.1 <=0.1.2), ai.databand:dbnd-agent (>=0.82.9 <=1.0.28.1) +12963 more potentially affected by CVE-2023-3635 via com.squareup.okio:okio-jvm (>=3.0.0-alpha.10 <=3.3.0)

com.squareup.okio:okio-jvm MAVEN version =3.0.0-alpha.10, =0.1.1, =0.82.9, =0.82.9, =0.82.9, =0.82.9, =0.5.0, =0.5.0, =0.5.8, =0.5.0, =0.5.7, =0.5.0, =0.6.0, =0.6.0, =0.5.0, =0.5.0, =0.8.7 and more Source cves: CVE-2023-3635 Source advisory: OSV:GHSA-W33C-445M-F8W7...

ai.agenticants:ants-platform-java (>=0.1.1 <=0.1.2), ai.catboost:catboost-spark_3.4_2.12 (>=1.2 <=1.2.10) +14576 more potentially affected by CVE-2023-3635 via com.squareup.okio:okio (>=2.0.0-RC1 <=3.3.0)

com.squareup.okio:okio MAVEN version =2.0.0-RC1, =0.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =v0.0.1, =0.1.12, =0.1.2, =0.5.0, =0.5.0, =0.5.8, =0.5.0, =0.5.7, =0.5.0, =0.6.0, =0.8.7 and more Source cves: CVE-2023-3635 Source advisory: OSV:GHSA-W33C-445M-F8W7...