Multiple vulnerabilities in IBM Cloud Pak System



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2024-24557
CVE-2024-29018
CWE-ID CWE-345
CWE-669
Exploitation vector Network
Public exploit N/A
Vulnerable software
 IBM Cloud Pak System
Server applications / Server solutions for antivurus protection

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Insufficient verification of data authenticity

EUVDB-ID: #VU86049

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-24557

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient verification of data authenticity. A remote attacker can poison victim´s cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: before 2.3.4.1

CPE2.3 External links

http://www.ibm.com/support/pages/node/7174014


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect Resource Transfer Between Spheres

EUVDB-ID: #VU87658

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-29018

CWE-ID: CWE-669 - Incorrect Resource Transfer Between Spheres

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within external DNS requests from "internal" networks. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: before 2.3.4.1

CPE2.3 External links

http://www.ibm.com/support/pages/node/7174014


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###