Improper Control of Dynamically-Managed Code Resources in vm2 - CVE-2023-29199

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU75366

Improper Control of Dynamically-Managed Code Resources in vm2 - CVE-2023-29199

Published: April 20, 2023 / Updated: May 17, 2023


Vulnerability identifier: #VU75366
CSH Severity: Medium
CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2023-29199
CWE-ID: CWE-913
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an error within the source code transformer. A remote user can bypass handleException() and leak unsanitized host exceptions. The obtain information can be used to escape the sandbox and run arbitrary code in host context.


Affected software

vm2
API Gateway
API Manager
Multicluster Engine for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes
App Connect Enterprise Certified Container
IBM Cloud Pak for Watson AIOps

How to mitigate CVE-2023-29199

Install updates from vendor's website.

vm2 - update to 3.9.16
API Gateway - update to May 2023
API Manager - update to May 2023
Multicluster Engine for Kubernetes - addressed in versions 2.0.7, 2.1.5, 2.2.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.7, 2.6.4, 2.7.3
IBM Cloud Pak for Watson AIOps - update to 3.7.2
App Connect Enterprise Certified Container - addressed in versions 5.0.6, 8.1.0

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins