Allocation of Resources Without Limits or Throttling in go-libp2p - CVE-2023-39533

Vulnerability identifier: #VU82816

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-39533

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

go-libp2p
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Transformation Advisor
IBM Cloud Pak for Data Scheduling
IBM Observability with Instana
IBM Business Automation Manager Open Editions
ObjectScale
Cloud Pak for Network Automation
Planning Analytics Cartridge for Cloud Pak for Data
Robotic Process Automation for Cloud Pak
Cloud Pak for Data

Install updates from vendor's website.

go-libp2p - addressed in versions 0.27.8, 0.28.2, 0.29.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
IBM Business Automation Manager Open Editions - update to 9.0.1
ObjectScale - update to 1.4.0
Cloud Pak for Network Automation - update to 2.7
IBM Cloud Transformation Advisor - update to 3.8.2
Planning Analytics Cartridge for Cloud Pak for Data - update to 4.8.0
IBM Cloud Pak for Data Scheduling - update to 4.8.0
Cloud Pak for Data - update to 4.8.5
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.10
IBM Observability with Instana - update to 265

• https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d
• https://github.com/libp2p/go-libp2p/pull/2454
• https://github.com/quic-go/quic-go/pull/4012
• https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
• https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb
• https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017
• https://github.com/golang/go/issues/61460
• https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00

• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Planning Analytics Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• IBM Cloud Pak for Data Scheduling update for Go
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Dell ObjectScale
• Allocation of resources without limits or throttling in IBM Cloud Pak for Data