Improper Certificate Validation in JBoss Data Grid - CVE-2023-4586

Vulnerability identifier: #VU84031

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4586

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the Hot Rod client does not enable hostname validation when using TLS. A remote attacker can perform MitM attack.

JBoss Data Grid
Event Streams
Analytics Content Hub
Knowledge Catalog Premium Cartridge
Event Processing
Cloud Pak for Network Automation
Watson Studio on Cloud Pak for Data
IBM Event Endpoint Management
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
HPE Telco IP Mediation E-Media
IBM Maximo Application Suite
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
IBM Observability with Instana

Install updates from vendor's website.

JBoss Data Grid - update to 8.4.6
Analytics Content Hub - update to 2.2
Knowledge Catalog Premium Cartridge - update to 5.2
Event Processing - update to 1.1.0
Log Analysis - update to 1.3.8 Fix Pack 1
IBM Process Mining - update to 1.14.3
Cloud Pak for Network Automation - update to 2.6.4
IBM Cloud Transformation Advisor - update to 3.8.2
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
Watson Studio on Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.23, 6.2.0.22, 6.3.0.6
HPE Telco IP Mediation E-Media - update to 8.5.0
IBM Maximo Application Suite - addressed in versions 8.10.6, 8.11.1
IBM Event Endpoint Management - update to 11.1.0
Event Streams - update to 11.3.0
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library - update to 38.4
IBM Observability with Instana - update to 266

• https://access.redhat.com/security/cve/CVE-2023-4586
• https://bugzilla.redhat.com/show_bug.cgi?id=2235564
• https://access.redhat.com/errata/RHSA-2023:7676

• Improper certificate validation in Transport Module Common Integration Library
• Multiple vulnerabilities in Red Hat Data Grid 8.4
• IBM Process Mining update for Netty
• IBM Maximo Application Suite - Monitor Component update for Netty
• Improper input validation in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Improper certificate validation in IBM Event Streams
• Improper certificate validation in IBM Event Processing
• Improper certificate validation in IBM Event Endpoint Management
• Improper certificate validation in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Improper certificate validation in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in HPE Telco IP Mediation E-Media
• Multiple vulnerabilities in IBM Analytics Content Hub
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge