Multiple vulnerabilities in IBM watsonx Assistant for IBM Cloud Pak for Data

Published: 2025-02-06

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-45490 CVE-2024-45492
CWE-ID	CWE-124 CWE-190
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	watsonx Assistant for IBM Cloud Pak for Data Other software / Other software solutions
Vendor	IBM Corporation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Buffer Underwrite ('Buffer Underflow')

EUVDB-ID: #VU96897

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-45490

CWE-ID: CWE-124 - Buffer Underwrite ('Buffer Underflow')

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in xmlparse.c when handling negative length for XML_ParseBuffer. A remote attacker can pass specially crafted input to the application, trigger buffer underflow and execute arbitrary code on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

watsonx Assistant for IBM Cloud Pak for Data: before 4.8.8

CPE2.3

cpe:2.3:a:ibm_corporation:watsonx_assistant_for_ibm_cloud_pak_for_data:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7182635

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU96899