Infinite loop in Apache Commons Compress - CVE-2024-25710
Published: February 20, 2024
Vulnerability identifier: #VU86624
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-25710
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing a corrupt DUMP file. A remote attacker can consume all available system resources and cause denial of service conditions.
Affected software
Apache Commons Compress
Amazon Linux AMI
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Server Module
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
Anolis OS
Cloud Pak for Security (CP4S)
Oracle Analytics Desktop
IBM Qradar SIEM
JBoss Data Grid
IBM Cognos Controller
IBM License Metric Tool
IBM Cognos Command Center
Event Streams
IBM Integrated Analytics System
Oracle Business Process Management Suite
Astronomer with IBM
Cloud Pak for Network Automation
Tivoli Network Manager IP Edition
Db2 Big SQL
IBM OpenPages with Watson
IBM Business Automation Manager Open Editions
Datacap
Oracle Data Integrator
IBM Application Suite - IBM Asset Data Dictionary Component
Event Processing
IBM Planning Analytics Workspace
Storage Copy Data Management
PowerStore T
Suite License Service
TPF Toolkit
User Entity Behavior Analytics
Cognos Dashboards on Cloud Pak for Data
Engineering Lifecycle Management - Jazz Foundation
Storage Protect Server
Storage Virtualize
Maximo Application Suite - Monitor Component
Storage Protect Plus Server
IBM Event Endpoint Management
Business Automation Insights
Storage Insights - Data Collector
IBM Cloud Pak for Data System
Migration Toolkit for Runtimes
IBM Process Mining
IBM Cloud Transformation Advisor
Red Hat build of Quarkus
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Sterling Control Center
Confluence Data Center
IBM Tivoli Netcool/OMNIbus WebGUI
WebSphere Remote Server
Bamboo Server
IBM Security Verify Governance
InfoSphere Master Data Management
IBM Observability with Instana
IBM Operator for Apache Flink
Log Analysis
Red Hat Integration - Service Registry
IBM Fusion HCI
Red Hat Integration Camel Extensions for Quarkus
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Object Storage Systems
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Spectrum Control
Dell Secure Connect Gateway
IBM Tivoli Business Service Manager
Red Hat Migration Toolkit for Applications
UCD - IBM UrbanCode Deploy
IBM Tivoli Netcool Impact
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
Bitbucket Data Center
IBM Common Licensing
IBM Workload Scheduler
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Automation Decision Services
Voice Gateway
QRadar Suite
Splunk Enterprise
DataEase
Oracle JDeveloper
IBM App Connect Enterprise
Confluence Server
JD Edwards EnterpriseOne Tools
IBM i Access Client Solutions
IBM Disconnected Log Collector
IBM DB2
Oracle Communications Cloud Native Core Unified Data Repository
Import tests from maven
sbt-bootstrap
sbt
maven-resolver-impl
maven-resolver-transport-file
maven-resolver-connector-basic
maven-resolver-javadoc
maven-resolver-transport-classpath
maven-resolver-transport-wagon
maven-resolver
maven-resolver-transport-http
maven-resolver-test-util
maven-resolver-api
maven-resolver-named-locks
maven-resolver-spi
maven-resolver-util
maven-doxia-sitetools-javadoc
maven-doxia-sitetools
maven-doxia-module-xdoc
maven-doxia-module-confluence
maven-doxia-core
maven-doxia-module-apt
maven-doxia-module-latex
maven-doxia-module-twiki
maven-doxia-module-rtf
maven-doxia-module-docbook-simple
maven-doxia-test-docs
maven-doxia-sink-api
maven-doxia-logging-api
maven-doxia-javadoc
maven-doxia-module-fo
maven-doxia-module-xhtml5
maven-doxia-module-xhtml
maven-doxia-module-fml
apache-commons-codec-javadoc
apache-commons-codec
apache-commons-compress
apache-commons-compress-javadoc
apache-commons-configuration2
apache-commons-configuration2-javadoc
apache-commons-io-javadoc
apache-commons-io
maven-reporting-api-javadoc
maven-reporting-api
maven-reporting-impl
maven-reporting-impl-javadoc
maven-jar-plugin-javadoc
maven-jar-plugin-bootstrap
maven-jar-plugin
maven-resources-plugin
maven-resources-plugin-javadoc
maven-resources-plugin-bootstrap
maven-assembly-plugin
maven-assembly-plugin-javadoc
maven-javadoc-plugin-bootstrap
maven-javadoc-plugin-javadoc
maven-javadoc-plugin
maven-javadoc
maven
maven-lib
xmvn-connector
xmvn-resolve
xmvn-mojo
xmvn-core
xmvn-install
xmvn-subst
xmvn-minimal
xmvn
xmvn-mojo-javadoc
xmvn-tools-javadoc
xmvn-connector-javadoc
xmvn-parent
xmvn-api
gradle-local
maven-local
ivy-local
Red Hat OpenShift Serverless
watsonx.data
IBM Cloud Pak System
AMQ Streams
AMQ Broker
Bitbucket Server
IBM Content Navigator
Operational Decision Manager
Amazon Linux AMI
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Server Module
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
Anolis OS
Cloud Pak for Security (CP4S)
Oracle Analytics Desktop
IBM Qradar SIEM
JBoss Data Grid
IBM Cognos Controller
IBM License Metric Tool
IBM Cognos Command Center
Event Streams
IBM Integrated Analytics System
Oracle Business Process Management Suite
Astronomer with IBM
Cloud Pak for Network Automation
Tivoli Network Manager IP Edition
Db2 Big SQL
IBM OpenPages with Watson
IBM Business Automation Manager Open Editions
Datacap
Oracle Data Integrator
IBM Application Suite - IBM Asset Data Dictionary Component
Event Processing
IBM Planning Analytics Workspace
Storage Copy Data Management
PowerStore T
Suite License Service
TPF Toolkit
User Entity Behavior Analytics
Cognos Dashboards on Cloud Pak for Data
Engineering Lifecycle Management - Jazz Foundation
Storage Protect Server
Storage Virtualize
Maximo Application Suite - Monitor Component
Storage Protect Plus Server
IBM Event Endpoint Management
Business Automation Insights
Storage Insights - Data Collector
IBM Cloud Pak for Data System
Migration Toolkit for Runtimes
IBM Process Mining
IBM Cloud Transformation Advisor
Red Hat build of Quarkus
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Sterling Control Center
Confluence Data Center
IBM Tivoli Netcool/OMNIbus WebGUI
WebSphere Remote Server
Bamboo Server
IBM Security Verify Governance
InfoSphere Master Data Management
IBM Observability with Instana
IBM Operator for Apache Flink
Log Analysis
Red Hat Integration - Service Registry
IBM Fusion HCI
Red Hat Integration Camel Extensions for Quarkus
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Object Storage Systems
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Spectrum Control
Dell Secure Connect Gateway
IBM Tivoli Business Service Manager
Red Hat Migration Toolkit for Applications
UCD - IBM UrbanCode Deploy
IBM Tivoli Netcool Impact
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
Bitbucket Data Center
IBM Common Licensing
IBM Workload Scheduler
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Automation Decision Services
Voice Gateway
QRadar Suite
Splunk Enterprise
DataEase
Oracle JDeveloper
IBM App Connect Enterprise
Confluence Server
JD Edwards EnterpriseOne Tools
IBM i Access Client Solutions
IBM Disconnected Log Collector
IBM DB2
Oracle Communications Cloud Native Core Unified Data Repository
Import tests from maven
sbt-bootstrap
sbt
maven-resolver-impl
maven-resolver-transport-file
maven-resolver-connector-basic
maven-resolver-javadoc
maven-resolver-transport-classpath
maven-resolver-transport-wagon
maven-resolver
maven-resolver-transport-http
maven-resolver-test-util
maven-resolver-api
maven-resolver-named-locks
maven-resolver-spi
maven-resolver-util
maven-doxia-sitetools-javadoc
maven-doxia-sitetools
maven-doxia-module-xdoc
maven-doxia-module-confluence
maven-doxia-core
maven-doxia-module-apt
maven-doxia-module-latex
maven-doxia-module-twiki
maven-doxia-module-rtf
maven-doxia-module-docbook-simple
maven-doxia-test-docs
maven-doxia-sink-api
maven-doxia-logging-api
maven-doxia-javadoc
maven-doxia-module-fo
maven-doxia-module-xhtml5
maven-doxia-module-xhtml
maven-doxia-module-fml
apache-commons-codec-javadoc
apache-commons-codec
apache-commons-compress
apache-commons-compress-javadoc
apache-commons-configuration2
apache-commons-configuration2-javadoc
apache-commons-io-javadoc
apache-commons-io
maven-reporting-api-javadoc
maven-reporting-api
maven-reporting-impl
maven-reporting-impl-javadoc
maven-jar-plugin-javadoc
maven-jar-plugin-bootstrap
maven-jar-plugin
maven-resources-plugin
maven-resources-plugin-javadoc
maven-resources-plugin-bootstrap
maven-assembly-plugin
maven-assembly-plugin-javadoc
maven-javadoc-plugin-bootstrap
maven-javadoc-plugin-javadoc
maven-javadoc-plugin
maven-javadoc
maven
maven-lib
xmvn-connector
xmvn-resolve
xmvn-mojo
xmvn-core
xmvn-install
xmvn-subst
xmvn-minimal
xmvn
xmvn-mojo-javadoc
xmvn-tools-javadoc
xmvn-connector-javadoc
xmvn-parent
xmvn-api
gradle-local
maven-local
ivy-local
Red Hat OpenShift Serverless
watsonx.data
IBM Cloud Pak System
AMQ Streams
AMQ Broker
Bitbucket Server
IBM Content Navigator
Operational Decision Manager
How to mitigate CVE-2024-25710
Install updates from vendor's website.
Apache Commons Compress - update to 1.26.0
IBM Integrated Analytics System - update to 1.0.31.0
Astronomer with IBM - update to 1.0.1
IBM Cloud Pak for Data System - update to 1.0.9.0
Voice Gateway - update to 1.0.8.19
Migration Toolkit for Runtimes - update to 1.2.5
QRadar Suite - update to 1.10.20.0
IBM Process Mining - update to 1.15.0
DataEase - update to 2.7.0
IBM Cloud Transformation Advisor - addressed in versions 3.9.0, 3.10.2
Cloud Pak for Network Automation - update to 2.7.1
Red Hat build of Quarkus - addressed in versions 2.13.9.SP2, 3.2.11
Tivoli Network Manager IP Edition - update to 4.2.0.20
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Sterling Control Center - addressed in versions 6.2.1.0.15, 6.3.1.0.3
Db2 Big SQL - update to 7.6.8
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
Confluence Data Center - addressed in versions 7.19.25, 8.5.12, 8.9.4
Confluence Server - addressed in versions 7.19.25, 8.5.12, 8.9.4
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.34
JBoss Data Grid - update to 8.4.7
IBM Business Automation Manager Open Editions - update to 9.1.1
Bamboo Server - addressed in versions 9.2.12, 9.4.4, 9.5.2
Splunk Enterprise - addressed in versions 9.1.7, 9.2.4, 9.3.2
IBM Cognos Controller - update to 11.0.1.0.3
IBM Observability with Instana - update to 274
Import tests from maven - update to site-plugin
sbt-bootstrap - update to 0.13.18-150200.4.19.7
sbt - update to 0.13.18-150200.4.19.7
IBM Operator for Apache Flink - update to 1.1.3
IBM i Access Client Solutions - update to 1.1.9.5
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
Event Processing - update to 1.2.1
Log Analysis - update to 1.3.8.1 IF001
IBM Disconnected Log Collector - update to 1.8.6
maven-resolver-impl - update to 1.9.18-150200.3.17.2
maven-resolver-transport-file - update to 1.9.18-150200.3.17.2
maven-resolver-connector-basic - update to 1.9.18-150200.3.17.2
maven-resolver-javadoc - update to 1.9.18-150200.3.17.2
maven-resolver-transport-classpath - update to 1.9.18-150200.3.17.2
maven-resolver-transport-wagon - update to 1.9.18-150200.3.17.2
maven-resolver - update to 1.9.18-150200.3.17.2
maven-resolver-transport-http - update to 1.9.18-150200.3.17.2
maven-resolver-test-util - update to 1.9.18-150200.3.17.2
maven-resolver-api - update to 1.9.18-150200.3.17.2
maven-resolver-named-locks - update to 1.9.18-150200.3.17.2
maven-resolver-spi - update to 1.9.18-150200.3.17.2
maven-resolver-util - update to 1.9.18-150200.3.17.2
maven-doxia-sitetools-javadoc - update to 1.11.1-150200.3.7.1
maven-doxia-sitetools - update to 1.11.1-150200.3.7.1
maven-doxia-module-xdoc - update to 1.12.0-150200.4.7.2
maven-doxia-module-confluence - update to 1.12.0-150200.4.7.2
maven-doxia-core - update to 1.12.0-150200.4.7.2
maven-doxia-module-apt - update to 1.12.0-150200.4.7.2
maven-doxia-module-latex - update to 1.12.0-150200.4.7.2
maven-doxia-module-twiki - update to 1.12.0-150200.4.7.2
maven-doxia-module-rtf - update to 1.12.0-150200.4.7.2
maven-doxia-module-docbook-simple - update to 1.12.0-150200.4.7.2
maven-doxia-test-docs - update to 1.12.0-150200.4.7.2
maven-doxia-sink-api - update to 1.12.0-150200.4.7.2
maven-doxia-logging-api - update to 1.12.0-150200.4.7.2
maven-doxia-javadoc - update to 1.12.0-150200.4.7.2
maven-doxia-module-fo - update to 1.12.0-150200.4.7.2
maven-doxia-module-xhtml5 - update to 1.12.0-150200.4.7.2
maven-doxia-module-xhtml - update to 1.12.0-150200.4.7.2
maven-doxia-module-fml - update to 1.12.0-150200.4.7.2
apache-commons-codec-javadoc - update to 1.16.1-150200.3.9.1
apache-commons-codec - update to 1.16.1-150200.3.9.1
apache-commons-compress - update to 1.21-4
apache-commons-compress - update to 1.25.0-1
apache-commons-compress-javadoc - update to 1.25.0-1
apache-commons-compress - update to 1.26.0-150200.3.16.1
apache-commons-compress-javadoc - update to 1.26.0-150200.3.16.1
Red Hat OpenShift Serverless - update to 1.33.0
IBM Planning Analytics Workspace - addressed in versions 2.0.95, 2.1.2
watsonx.data - update to 2.1
Storage Copy Data Management - update to 2.2.23.1
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
Red Hat Integration - Service Registry - update to 2.5.11
AMQ Streams - update to 2.7.0
IBM Fusion HCI - update to 2.8.0
apache-commons-configuration2 - update to 2.9.0-150200.5.5.1
apache-commons-configuration2-javadoc - update to 2.9.0-150200.5.5.1
Red Hat Integration Camel Extensions for Quarkus - addressed in versions 2.13.9.SP2, 3.2.11
apache-commons-io-javadoc - update to 2.15.1-150200.3.12.1
apache-commons-io - update to 2.15.1-150200.3.12.1
IBM Content Navigator - addressed in versions 3.0.11 IF016, 3.0.14 IF005, 3.0.15 IF002
maven-reporting-api-javadoc - update to 3.1.1-150200.3.7.1
maven-reporting-api - update to 3.1.1-150200.3.7.1
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.3
maven-reporting-impl - update to 3.2.0-150200.4.6.2
maven-reporting-impl-javadoc - update to 3.2.0-150200.4.6.2
maven-jar-plugin-javadoc - update to 3.3.0-150200.3.10.1
maven-jar-plugin-bootstrap - update to 3.3.0-150200.3.10.1
maven-jar-plugin - update to 3.3.0-150200.3.10.1
maven-resources-plugin - update to 3.3.1-150200.3.12.1
maven-resources-plugin-javadoc - update to 3.3.1-150200.3.12.1
maven-resources-plugin-bootstrap - update to 3.3.1-150200.3.12.1
maven-assembly-plugin - update to 3.6.0-150200.3.10.1
maven-assembly-plugin-javadoc - update to 3.6.0-150200.3.10.1
maven-javadoc-plugin-bootstrap - update to 3.6.0-150200.4.10.1
maven-javadoc-plugin-javadoc - update to 3.6.0-150200.4.10.1
maven-javadoc-plugin - update to 3.6.0-150200.4.10.1
PowerStore T - update to 3.6.1.4-2413340
Suite License Service - update to 3.9.0
maven-javadoc - update to 3.9.6-150200.4.21.2
maven - update to 3.9.6-150200.4.21.2
maven-lib - update to 3.9.6-150200.4.21.2
IBM Cloud Object Storage Systems - addressed in versions 3.18.0.50, 3.18.2.45
xmvn-connector - update to 4.2.0-150200.3.18.1
xmvn-resolve - update to 4.2.0-150200.3.18.1
xmvn-mojo - update to 4.2.0-150200.3.18.1
xmvn-core - update to 4.2.0-150200.3.18.1
xmvn-install - update to 4.2.0-150200.3.18.1
xmvn-subst - update to 4.2.0-150200.3.18.1
xmvn-minimal - update to 4.2.0-150200.3.18.1
xmvn - update to 4.2.0-150200.3.18.1
xmvn-mojo-javadoc - update to 4.2.0-150200.3.18.1
xmvn-tools-javadoc - update to 4.2.0-150200.3.18.1
xmvn-connector-javadoc - update to 4.2.0-150200.3.18.1
xmvn-parent - update to 4.2.0-150200.3.18.1
xmvn-api - update to 4.2.0-150200.3.18.1
TPF Toolkit - update to 4.6 FP18
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.4
User Entity Behavior Analytics - update to 5.0.2
Cognos Dashboards on Cloud Pak for Data - update to 5.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.1
IBM Spectrum Control - update to 5.4.12
Dell Secure Connect Gateway - update to 5.24.00.14
IBM Tivoli Business Service Manager - update to 6.2.0.5.5
gradle-local - update to 6.2.0-150200.3.7.1
maven-local - update to 6.2.0-150200.3.7.1
ivy-local - update to 6.2.0-150200.3.7.1
Red Hat Migration Toolkit for Applications - update to 6.2.3
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.2 iFix033, 7.0.3 iFix013, 7.1.0 iFix003
UCD - IBM UrbanCode Deploy - addressed in versions 7.0.5.21, 7.1.2.17, 7.2.3.10, 7.3.2.5, 8.0.1.0
IBM Tivoli Netcool Impact - update to 7.1.0.33
IBM Maximo Asset Management - update to 7.6.1.3.22
AMQ Broker - update to 7.13.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.24
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.22
Storage Virtualize - addressed in versions 8.6.0.4, 8.7.0.0
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.16, 8.7.10, 9.0.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
IBM Maximo Application Suite - addressed in versions 8.10.18, 8.11.15, 9.0.3, 9.1.0
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 32, 8.11.1 Interim fix 25, 8.12.0.1 Interim fix 10
Bitbucket Server - update to 8.19.25
Bitbucket Data Center - update to 8.19.25
IBM Common Licensing - update to 9.0.0.1
IBM License Metric Tool - update to 9.2.35
IBM Workload Scheduler - addressed in versions 9.5.0.7, 10.1.0.5, 10.2.2
Storage Protect Plus Server - update to 10.1.16.3
IBM Cognos Command Center - update to 10.2.5 IF2
IBM App Connect Enterprise - addressed in versions 11.0.0.26, 12.0.12.2
IBM Event Endpoint Management - update to 11.2.1
Event Streams - update to 11.5.1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF033, 23.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.31, 23.0.2.3
IBM Automation Decision Services - update to 23.0.2.0.3
Business Automation Insights - update to 23.0.2.0.3
Storage Insights - Data Collector - update to 20240412-0155
IBM Integrated Analytics System - update to 1.0.31.0
Astronomer with IBM - update to 1.0.1
IBM Cloud Pak for Data System - update to 1.0.9.0
Voice Gateway - update to 1.0.8.19
Migration Toolkit for Runtimes - update to 1.2.5
QRadar Suite - update to 1.10.20.0
IBM Process Mining - update to 1.15.0
DataEase - update to 2.7.0
IBM Cloud Transformation Advisor - addressed in versions 3.9.0, 3.10.2
Cloud Pak for Network Automation - update to 2.7.1
Red Hat build of Quarkus - addressed in versions 2.13.9.SP2, 3.2.11
Tivoli Network Manager IP Edition - update to 4.2.0.20
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Sterling Control Center - addressed in versions 6.2.1.0.15, 6.3.1.0.3
Db2 Big SQL - update to 7.6.8
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
Confluence Data Center - addressed in versions 7.19.25, 8.5.12, 8.9.4
Confluence Server - addressed in versions 7.19.25, 8.5.12, 8.9.4
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.34
JBoss Data Grid - update to 8.4.7
IBM Business Automation Manager Open Editions - update to 9.1.1
Bamboo Server - addressed in versions 9.2.12, 9.4.4, 9.5.2
Splunk Enterprise - addressed in versions 9.1.7, 9.2.4, 9.3.2
IBM Cognos Controller - update to 11.0.1.0.3
IBM Observability with Instana - update to 274
Import tests from maven - update to site-plugin
sbt-bootstrap - update to 0.13.18-150200.4.19.7
sbt - update to 0.13.18-150200.4.19.7
IBM Operator for Apache Flink - update to 1.1.3
IBM i Access Client Solutions - update to 1.1.9.5
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
Event Processing - update to 1.2.1
Log Analysis - update to 1.3.8.1 IF001
IBM Disconnected Log Collector - update to 1.8.6
maven-resolver-impl - update to 1.9.18-150200.3.17.2
maven-resolver-transport-file - update to 1.9.18-150200.3.17.2
maven-resolver-connector-basic - update to 1.9.18-150200.3.17.2
maven-resolver-javadoc - update to 1.9.18-150200.3.17.2
maven-resolver-transport-classpath - update to 1.9.18-150200.3.17.2
maven-resolver-transport-wagon - update to 1.9.18-150200.3.17.2
maven-resolver - update to 1.9.18-150200.3.17.2
maven-resolver-transport-http - update to 1.9.18-150200.3.17.2
maven-resolver-test-util - update to 1.9.18-150200.3.17.2
maven-resolver-api - update to 1.9.18-150200.3.17.2
maven-resolver-named-locks - update to 1.9.18-150200.3.17.2
maven-resolver-spi - update to 1.9.18-150200.3.17.2
maven-resolver-util - update to 1.9.18-150200.3.17.2
maven-doxia-sitetools-javadoc - update to 1.11.1-150200.3.7.1
maven-doxia-sitetools - update to 1.11.1-150200.3.7.1
maven-doxia-module-xdoc - update to 1.12.0-150200.4.7.2
maven-doxia-module-confluence - update to 1.12.0-150200.4.7.2
maven-doxia-core - update to 1.12.0-150200.4.7.2
maven-doxia-module-apt - update to 1.12.0-150200.4.7.2
maven-doxia-module-latex - update to 1.12.0-150200.4.7.2
maven-doxia-module-twiki - update to 1.12.0-150200.4.7.2
maven-doxia-module-rtf - update to 1.12.0-150200.4.7.2
maven-doxia-module-docbook-simple - update to 1.12.0-150200.4.7.2
maven-doxia-test-docs - update to 1.12.0-150200.4.7.2
maven-doxia-sink-api - update to 1.12.0-150200.4.7.2
maven-doxia-logging-api - update to 1.12.0-150200.4.7.2
maven-doxia-javadoc - update to 1.12.0-150200.4.7.2
maven-doxia-module-fo - update to 1.12.0-150200.4.7.2
maven-doxia-module-xhtml5 - update to 1.12.0-150200.4.7.2
maven-doxia-module-xhtml - update to 1.12.0-150200.4.7.2
maven-doxia-module-fml - update to 1.12.0-150200.4.7.2
apache-commons-codec-javadoc - update to 1.16.1-150200.3.9.1
apache-commons-codec - update to 1.16.1-150200.3.9.1
apache-commons-compress - update to 1.21-4
apache-commons-compress - update to 1.25.0-1
apache-commons-compress-javadoc - update to 1.25.0-1
apache-commons-compress - update to 1.26.0-150200.3.16.1
apache-commons-compress-javadoc - update to 1.26.0-150200.3.16.1
Red Hat OpenShift Serverless - update to 1.33.0
IBM Planning Analytics Workspace - addressed in versions 2.0.95, 2.1.2
watsonx.data - update to 2.1
Storage Copy Data Management - update to 2.2.23.1
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
Red Hat Integration - Service Registry - update to 2.5.11
AMQ Streams - update to 2.7.0
IBM Fusion HCI - update to 2.8.0
apache-commons-configuration2 - update to 2.9.0-150200.5.5.1
apache-commons-configuration2-javadoc - update to 2.9.0-150200.5.5.1
Red Hat Integration Camel Extensions for Quarkus - addressed in versions 2.13.9.SP2, 3.2.11
apache-commons-io-javadoc - update to 2.15.1-150200.3.12.1
apache-commons-io - update to 2.15.1-150200.3.12.1
IBM Content Navigator - addressed in versions 3.0.11 IF016, 3.0.14 IF005, 3.0.15 IF002
maven-reporting-api-javadoc - update to 3.1.1-150200.3.7.1
maven-reporting-api - update to 3.1.1-150200.3.7.1
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.3
maven-reporting-impl - update to 3.2.0-150200.4.6.2
maven-reporting-impl-javadoc - update to 3.2.0-150200.4.6.2
maven-jar-plugin-javadoc - update to 3.3.0-150200.3.10.1
maven-jar-plugin-bootstrap - update to 3.3.0-150200.3.10.1
maven-jar-plugin - update to 3.3.0-150200.3.10.1
maven-resources-plugin - update to 3.3.1-150200.3.12.1
maven-resources-plugin-javadoc - update to 3.3.1-150200.3.12.1
maven-resources-plugin-bootstrap - update to 3.3.1-150200.3.12.1
maven-assembly-plugin - update to 3.6.0-150200.3.10.1
maven-assembly-plugin-javadoc - update to 3.6.0-150200.3.10.1
maven-javadoc-plugin-bootstrap - update to 3.6.0-150200.4.10.1
maven-javadoc-plugin-javadoc - update to 3.6.0-150200.4.10.1
maven-javadoc-plugin - update to 3.6.0-150200.4.10.1
PowerStore T - update to 3.6.1.4-2413340
Suite License Service - update to 3.9.0
maven-javadoc - update to 3.9.6-150200.4.21.2
maven - update to 3.9.6-150200.4.21.2
maven-lib - update to 3.9.6-150200.4.21.2
IBM Cloud Object Storage Systems - addressed in versions 3.18.0.50, 3.18.2.45
xmvn-connector - update to 4.2.0-150200.3.18.1
xmvn-resolve - update to 4.2.0-150200.3.18.1
xmvn-mojo - update to 4.2.0-150200.3.18.1
xmvn-core - update to 4.2.0-150200.3.18.1
xmvn-install - update to 4.2.0-150200.3.18.1
xmvn-subst - update to 4.2.0-150200.3.18.1
xmvn-minimal - update to 4.2.0-150200.3.18.1
xmvn - update to 4.2.0-150200.3.18.1
xmvn-mojo-javadoc - update to 4.2.0-150200.3.18.1
xmvn-tools-javadoc - update to 4.2.0-150200.3.18.1
xmvn-connector-javadoc - update to 4.2.0-150200.3.18.1
xmvn-parent - update to 4.2.0-150200.3.18.1
xmvn-api - update to 4.2.0-150200.3.18.1
TPF Toolkit - update to 4.6 FP18
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.4
User Entity Behavior Analytics - update to 5.0.2
Cognos Dashboards on Cloud Pak for Data - update to 5.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.1
IBM Spectrum Control - update to 5.4.12
Dell Secure Connect Gateway - update to 5.24.00.14
IBM Tivoli Business Service Manager - update to 6.2.0.5.5
gradle-local - update to 6.2.0-150200.3.7.1
maven-local - update to 6.2.0-150200.3.7.1
ivy-local - update to 6.2.0-150200.3.7.1
Red Hat Migration Toolkit for Applications - update to 6.2.3
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.2 iFix033, 7.0.3 iFix013, 7.1.0 iFix003
UCD - IBM UrbanCode Deploy - addressed in versions 7.0.5.21, 7.1.2.17, 7.2.3.10, 7.3.2.5, 8.0.1.0
IBM Tivoli Netcool Impact - update to 7.1.0.33
IBM Maximo Asset Management - update to 7.6.1.3.22
AMQ Broker - update to 7.13.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.24
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.22
Storage Virtualize - addressed in versions 8.6.0.4, 8.7.0.0
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.16, 8.7.10, 9.0.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
IBM Maximo Application Suite - addressed in versions 8.10.18, 8.11.15, 9.0.3, 9.1.0
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 32, 8.11.1 Interim fix 25, 8.12.0.1 Interim fix 10
Bitbucket Server - update to 8.19.25
Bitbucket Data Center - update to 8.19.25
IBM Common Licensing - update to 9.0.0.1
IBM License Metric Tool - update to 9.2.35
IBM Workload Scheduler - addressed in versions 9.5.0.7, 10.1.0.5, 10.2.2
Storage Protect Plus Server - update to 10.1.16.3
IBM Cognos Command Center - update to 10.2.5 IF2
IBM App Connect Enterprise - addressed in versions 11.0.0.26, 12.0.12.2
IBM Event Endpoint Management - update to 11.2.1
Event Streams - update to 11.5.1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF033, 23.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.31, 23.0.2.3
IBM Automation Decision Services - update to 23.0.2.0.3
Business Automation Insights - update to 23.0.2.0.3
Storage Insights - Data Collector - update to 20240412-0155
External References
Related Security Bulletins
- Multiple vulnerabilities in Apache Commons Compress
- SUSE update for Java
- Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI
- Multiple vulnerabilities in IBM Cloud Transformation Advisor
- Multiple vulnerabilities in IBM License Metric Tool
- Multiple vulnerabilities in Red Hat Data Grid 8.4
- Multiple vulnerabilities in IBM Business Automation Insights
- Multiple vulnerabilities in IBM Automation Decision Services
- Multiple vulnerabilities in IBM Cloud Object System
- Multiple vulnerabilities in IBM Cloud Pak for Network Automation
- Multiple vulnerabilities in IBM Tivoli Netcool Impact
- Multiple vulnerabilities in IBM Cloud Pak for Business Automation
- Multiple vulnerabilities in IBM QRadar Suite Software
- Multiple vulnerabilities in IBM UrbanCode Deploy
- Multiple vulnerabilities in IBM Cognos Command Center
- Migration Toolkit for Runtimes 1.2 update for commons-compress
- Multiple vulnerabilities in Red Hat build of Quarkus 2.13
- Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus
- Multiple vulnerabilities in Red Hat build of Quarkus 3.2
- Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
- Multiple vulnerabilities in IBM Storage Copy Data Management
- Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
- Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
- Multiple vulnerabilities in TPF Toolkit
- Multiple vulnerabilities in IBM Storage Fusion
- Multiple vulnerabilities in IBM App Connect Enterprise
- Multiple vulnerabilities in IBM Storage Insights - Data Collector
- Multiple vulnerabilities in IBM i Access Family
- Multiple vulnerabilities in IBM Watson Discovery
- Multiple vulnerabilities in IBM Business Automation Workflow
- Multiple vulnerabilities in Dell Secure Connect Gateway
- Multiple vulnerabilities in Red Hat Integration - Service Registry 2.5
- Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 3.2
- Multiple vulnerabilities in AMQ Streams 2.7
- Multiple vulnerabilities in IBM Observability with Instana
- Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 6.2
- Multiple vulnerabilities in Red Hat OpenShift Serverless 1
- Multiple vulnerabilities in IBM Operator for Apache Flink
- Multiple vulnerabilities in IBM Suite License Service
- Dataease update for Apache Commons Compress
- Multiple vulnerabilities in IBM Process Mining
- Multiple vulnerabilities in IBM Db2
- Multiple vulnerabilities in IBM Storage Virtualize
- Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
- Multiple vulnerabilities in Oracle Analytics Desktop
- Multiple vulnerabilities in IBM WebSphere Remote Server
- Multiple vulnerabilities in IBM Cloud APM
- Amazon Linux AMI update for javapackages-bootstrap
- Amazon Linux AMI update for apache-commons-compress
- Multiple vulnerabilities in IBM Operational Decision Manager
- Multiple vulnerabilities in IBM Maximo Asset Management
- Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
- Multiple vulnerabilities in IBM OpenPages with Watson
- Multiple vulnerabilities in IBM Event Endpoint Management
- Multiple vulnerabilities in IBM Disconnected Log Collector
- Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
- Multiple vulnerabilities in IBM Security Verify Governance
- Multiple vulnerabilities in IBM Spectrum Control
- Multiple vulnerabilities in IBM Content Navigator
- Multiple vulnerabilities in IBM Common Licensing
- Multiple vulnerabilities in Datacap
- Multiple vulnerabilities in IBM Workload Scheduler
- Multiple vulnerabilities in IBM Tivoli Business Service Manager
- Multiple vulnerabilities in IBM Storage Protect Plus
- Multiple vulnerabilities in IBM Business Automation Manager Open Editions
- Multiple vulnerabilities in IBM InfoSphere Master Data Management
- Multiple vulnerabilities in IBM Event Processing
- Multiple vulnerabilities in IBM Storage Protect Server
- Multiple vulnerabilities in IBM Maximo Application Suite
- Multiple vulnerabilities in IBM Cloud Pak System
- Multiple vulnerabilities in IBM Event Streams
- Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
- Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
- Multiple vulnerabilities in IBM Cloud Transformation Advisor
- IBM B2B Sterling Integrator update for Apache Commons Compress
- Multiple vulnerabilities in IBM Cognos Controller
- Bamboo Data Center and Server update for Apache Commons Compress
- Confluence Data Center and Server update for Apache Commons Compress
- Splunk Enterprise update for third-party components
- Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
- Multiple vulnerabilities in Dell PowerStore T
- IBM watsonx.data update for Apache Commons Compress
- Multiple vulnerabilities in IBM Asset Data Dictionary Component
- Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
- Multiple vulnerabilities in IBM Control Center
- Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
- Multiple vulnerabilities in HPE Unified OSS Console Assurance Monitoring (UOCAM)
- Multiple vulnerabilities in IBM Voice Gateway
- Multiple vulnerabilities in Oracle JDeveloper
- Infinite loop in Oracle Data Integrator
- Multiple vulnerabilities in Oracle Business Process Management Suite
- Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
- Multiple vulnerabilities in IBM Cloud Pak for Data System
- Multiple vulnerabilities in AMQ Broker 7.13
- Multiple vulnerabilities in IBM Integrated Analytics System
- Multiple vulnerabilities in IBM Watson Knowledge Catalog
- Multiple vulnerabilities in IBM QRadar SIEM
- Multiple vulnerabilities in Astronomer with IBM
- Multiple vulnerabilities in IBM Engineering Lifecycle Management - Jazz Foundation
- Anolis OS update for apache-commons-compress
- Multiple vulnerabilities in IBM User Entity Behavior Analytics
- Bitbucket Data Center and Server update for Apache Commons Compress
- Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data