Multiple vulnerabilities in IBM Event Streams

Published: 2023-10-11

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-4450 CVE-2023-0216
CWE-ID	CWE-415 CWE-763
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Event Streams Client/Desktop applications / Other client software
Vendor	IBM Corporation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Double Free

EUVDB-ID: #VU71996

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-4450

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the PEM_read_bio_ex() function. A remote attacker can pass specially crafted PEM file to the application, trigger a double free error and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Event Streams: before 11.2.3

External links

http://www.ibm.com/support/pages/node/7049142

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Release of invalid pointer or reference

EUVDB-ID: #VU71997