SB2024082005 - Multiple vulnerabilities in IBM Cloud Transformation Advisor
Published: August 20, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Deserialization of Untrusted Data (CVE-ID: CVE-2021-46877)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insecure input validation when processing serialized JsonNode values. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Note, the vulnerability affects JDK serialization only.
2) Improper Certificate Validation (CVE-ID: CVE-2021-0341)
The vulnerability allows a remote attacker to perform MitM attack.
the vulnerability exists due to improper certificate validation within the verifyHostName in OkHostnameVerifier.java in okhttp library in Android runtime. A remote attacker can force the system to accept a certificate for the wrong domain due to improperly used crypto and perform MitM attack.
3) Infinite loop (CVE-ID: CVE-2021-35515)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing 7Z archives. A remote attacker can consume all available system resources and cause denial of service conditions.
4) Resource exhaustion (CVE-ID: CVE-2021-35516)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing 7Z archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Infinite loop (CVE-ID: CVE-2024-30172)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the Ed25519 verification code. A remote attacker can pass a specially signature and public key to the application, consume all available system resources and cause denial of service conditions.
Remediation
Install update from vendor's website.