Resource exhaustion in Go programming language - CVE-2022-41727

Vulnerability identifier: #VU77521

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41727

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A local attacker can trick the victim into opening a specially crafted malformed TIFF image, trigger resource exhaustion and perform a denial of service (DoS) attack.

Go programming language
IBM Spectrum Copy Data Management
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Platform Navigator in IBM Cloud Pak for Integration (CP4I)

Install updates from vendor's website.

Go programming language - update to 0.5.0
IBM Spectrum Copy Data Management - update to 2.2.20.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.4
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.4
IBM Spectrum Protect Plus - update to 10.1.15
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-7
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-8, 2022.4.1-3

• https://go.dev/cl/468195
• https://go.dev/issue/58003
• https://groups.google.com/g/golang-announce/c/ag-FiyjlD5o
• https://pkg.go.dev/vuln/GO-2023-1572

• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift