SB2024080621 - Security restrictions bypass in IBM Watson Assistant for IBM Cloud Pak for Data
Published: August 6, 2024
Security Bulletin ID
SB2024080621
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Security restrictions bypass (CVE-ID: CVE-2018-1320)
The vulnerability allows a remote attacker to gain access to bypass security restrictions.
The vulnerability exists due to unspecified flaw. A remote attacker can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Remediation
Install update from vendor's website.