Input validation error in protobuf-go - CVE-2023-24535
Published: April 27, 2023
Vulnerability identifier: #VU75546
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-24535
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted message consisting of a minus sign to cause panic and perform a denial of service attack.
Affected software
protobuf-go
IBM Watson Assistant for IBM Cloud Pak for Data
Operations Dashboard
IBM Cloud Pak for Watson AIOps
IBM Watson Assistant for IBM Cloud Pak for Data
Operations Dashboard
IBM Cloud Pak for Watson AIOps
How to mitigate CVE-2023-24535
Install updates from vendor's website.
protobuf-go - update to 1.29.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Cloud Pak for Watson AIOps - update to 3.7.1
Operations Dashboard - update to 2022.2.1-10-lts
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Cloud Pak for Watson AIOps - update to 3.7.1
Operations Dashboard - update to 2022.2.1-10-lts