SB2025080821 - Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025080821

SB2025080821 - Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak

Published: August 8, 2025 Updated: December 11, 2025

Security Bulletin ID SB2025080821
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Memory leak (CVE-ID: CVE-2025-22866)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a small number of bits of secret scalars are leaked on the ppc64le architecture in crypto/internal/nistec. A local user can gain access to potentially sensitive information.


2) Input validation error (CVE-ID: CVE-2025-22870)

The vulnerability allows a remote attacker to alter application's behavior.

The vulnerability exists due to insufficient validation of an IPv6 zone ID as a hostname component, when matching hosts against proxy patterns. For instance the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. A remote attacker can alter application behavior and potentially  gain access to sensitive information or functionality.


3) Resource exhaustion (CVE-ID: CVE-2025-22869)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the ssh package when handling clients that complete the key exchange slowly, or not at all. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.


4) Input validation error (CVE-ID: CVE-2025-22872)

The vulnerability allows a remote attacker to perform code injection attacks.

The vulnerability exists due to insufficient validation of tags with unquoted attribute values that end with a solidus character (/). The tokenizer can interpret such tags as self-closing, leading to content following such tags as being placed in the wrong scope during DOM construction.


Remediation

Install update from vendor's website.

References