Improper input validation in PeopleSoft Enterprise PT PeopleTools - CVE-2017-18640

Vulnerability identifier: #VU52578

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-18640

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Application Server (SnakeYAML) component in PeopleSoft Enterprise PT PeopleTools. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

PeopleSoft Enterprise PT PeopleTools
Operational Decision Manager
Gentoo Linux
SUSE Linux Enterprise Module for SUSE Manager Server
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
SUSE Linux Enterprise Module for Development Tools
Fedora
Kaitai Struct: compiler
IBM Watson Machine Learning Accelerator
Guardium Data Security Center (GDSC)
Integration Designer
B2B Advanced Communications
Multi-Enterprise Integration Gateway
IBM Sterling Order Management
IBM PureData System for Operational Analytics
Log Analysis
IBM Sterling B2B Integrator
Red Hat build of Quarkus
IBM Spectrum Symphony
AMQ Streams
libyaml-snake-java (Ubuntu package)
prometheus-jmx-exporter (Red Hat package)
snakeyaml
dev-java/snakeyaml
watsonx.data

Install updates from vendor's website.

Kaitai Struct: compiler - update to 0.10
Log Analysis - update to 1.3.7.2 IF003
AMQ Streams - update to 1.8.0
Guardium Data Security Center (GDSC) - update to 3.6.1
IBM Sterling B2B Integrator - addressed in versions 6.0.3.6, 6.1.0.5, 6.1.1.0
libyaml-snake-java (Ubuntu package) - update to Ubuntu Pro
prometheus-jmx-exporter (Red Hat package) - update to 0.12.0-6.el8
B2B Advanced Communications - update to 1.0.0.8
Multi-Enterprise Integration Gateway - update to 1.0.0.8
Red Hat build of Quarkus - update to 1.3.4
snakeyaml - addressed in versions 1.26-1.fc31, 1.26-1.fc32
snakeyaml - addressed in versions 1.28-3.5.1, 1.28-12.3.1
dev-java/snakeyaml - update to 1.33
watsonx.data - update to 2.0
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
IBM Sterling Order Management - update to 10.0.2206.2

• https://www.oracle.com/security-alerts/cpuapr2021.html

• Multiple vulnerabilities in PeopleSoft Enterprise PT PeopleTools
• Multiple vulnerabilities in Red Hat AMQ Streams
• SUSE update for snakeyaml
• SUSE update for snakeyaml
• SUSE update for snakeyaml
• Multiple vulnerabilities in IBM PureData System for Operational Analytics
• Denial of service in Kaitai Struct: compiler
• Denial of service in IBM Sterling B2B Integrator
• IBM Log Analysis update for SnakeYAML
• Red Hat Enterprise Linux 8 update for prometheus-jmx-exporter
• Improper input validation in IBM B2B Advanced Communications
• Gentoo update for snakeyaml
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Improper input validation in IBM Sterling Order Management
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in IBM watsonx.data
• Ubuntu update for snakeyaml
• Improper input validation in Red Hat build of Quarkus 1.3
• Fedora 32 update for snakeyaml
• Fedora 31 update for snakeyaml