Resource exhaustion in jose4j - CVE-2023-51775
Published: April 5, 2024
Vulnerability identifier: #VU88173
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-51775
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion via large p2c (aka PBES2 Count) value and perform a denial of service (DoS) attack.
Affected software
jose4j
Engineering Workflow Management
IBM Business Automation Workflow
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Rational ClearQuest
IBM Rational ClearCase
IBM Intelligent Operations Center
IBM Operations Analytics Predictive Insights
IBM MQ Operator
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM SPSS Analytic Server
IBM Tivoli System Automation Application Manager
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Tivoli Netcool Impact
IBM Maximo Asset Management
WebSphere Service Registry and Repository
WebSphere Remote Server
IBM Security Verify Governance
InfoSphere Master Data Management
Oracle Middleware Common Libraries and Tools
Oracle Communications Cloud Native Core Automated Test Suite
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications EAGLE Element Management System
Jazz for Service Management
Log Analysis
IBM Cloud Pak for Security
IBM Process Mining
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Tivoli Monitoring
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
IBM TXSeries for Multiplatforms
IBM MQ
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Jazz Foundation
IBM CICS TX Advanced
IBM CICS TX Standard
IBM Engineering Requirements Management DOORS Next
Engineering Test Management
Intelligent Operations Center for Emergency Management
Tivoli Composite Application Manager for Application Diagnostics
IBM OpenPages with Watson
Business Monitor
Maximo Application Suite - Visual Inspection Component
IBM Security Verify Information Queue
DevOps
IBM Application Suite - IBM Asset Data Dictionary Component
PowerVM NovaLink
IBM Planning Analytics Workspace
Netezza Performance Server Replication Services
Storage Protect Operations Center
Maximo Application Suite - Monitor Component
Maximo Application Suite - Predict Component
Telco Service Activator
Robotic Process Automation for Cloud Pak
Business Automation Insights
IBM Content Navigator
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Server Module
SUSE Manager Retail Branch Server
SUSE Manager Proxy Module
openSUSE Leap
IBM Tivoli Application Dependency Discovery Manager
Oracle WebCenter Sites
JBoss Enterprise Application Platform
IBM WebSphere Application Server Liberty
AMQ Streams
IBM WebSphere Application Server
IBM Cognos Controller
Financial Transaction Manager
IBM Qradar SIEM
IBM License Metric Tool
Event Streams
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Service Communication Proxy
image-sync-formula
inter-server-sync-debuginfo
inter-server-sync
jose4j
subscription-matcher
eap7-insights-java-client (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-ironjacamar (Red Hat package)
smdba
eap7-jboss-server-migration (Red Hat package)
eap7-jsoup (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap7-xalan-j2 (Red Hat package)
cobbler
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
mgr-daemon
uyuni-reportdb-schema
python3-uyuni-common-libs
supportutils-plugin-susemanager
release-notes-susemanager-proxy
release-notes-susemanager
spacewalk-config
susemanager-sync-data
spacewalk-client-setup
spacewalk-check
python3-spacewalk-check
spacewalk-client-tools
python3-spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-certs-tools
python3-spacewalk-certs-tools
susemanager-schema
susemanager-schema-utility
spacecmd
spacewalk-backend-xml-export-libs
spacewalk-backend
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-xmlrpc
spacewalk-backend-sql
spacewalk-backend-iss
spacewalk-backend-server
spacewalk-backend-config-files-common
spacewalk-backend-tools
spacewalk-backend-config-files-tool
spacewalk-backend-sql-postgresql
spacewalk-backend-app
spacewalk-backend-config-files
spacewalk-backend-applet
susemanager-tools
susemanager
spacewalk-base-minimal
spacewalk-base
spacewalk-html
spacewalk-base-minimal-config
uyuni-config-modules
susemanager-sls
spacewalk-java-lib
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
spacewalk-java
susemanager-docs_en-pdf
susemanager-docs_en
eap7-jbossws-cxf (Red Hat package)
eap7-hibernate-validator (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat OpenShift Serverless
Planning Analytics Local
Operational Decision Manager
IBM Cognos Analytics
IBM Cloud Pak for Multicloud Management
IBM Cloud Pak System
IBM InfoSphere Information Server
Engineering Workflow Management
IBM Business Automation Workflow
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Rational ClearQuest
IBM Rational ClearCase
IBM Intelligent Operations Center
IBM Operations Analytics Predictive Insights
IBM MQ Operator
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM SPSS Analytic Server
IBM Tivoli System Automation Application Manager
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Tivoli Netcool Impact
IBM Maximo Asset Management
WebSphere Service Registry and Repository
WebSphere Remote Server
IBM Security Verify Governance
InfoSphere Master Data Management
Oracle Middleware Common Libraries and Tools
Oracle Communications Cloud Native Core Automated Test Suite
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications EAGLE Element Management System
Jazz for Service Management
Log Analysis
IBM Cloud Pak for Security
IBM Process Mining
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Tivoli Monitoring
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
IBM TXSeries for Multiplatforms
IBM MQ
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Jazz Foundation
IBM CICS TX Advanced
IBM CICS TX Standard
IBM Engineering Requirements Management DOORS Next
Engineering Test Management
Intelligent Operations Center for Emergency Management
Tivoli Composite Application Manager for Application Diagnostics
IBM OpenPages with Watson
Business Monitor
Maximo Application Suite - Visual Inspection Component
IBM Security Verify Information Queue
DevOps
IBM Application Suite - IBM Asset Data Dictionary Component
PowerVM NovaLink
IBM Planning Analytics Workspace
Netezza Performance Server Replication Services
Storage Protect Operations Center
Maximo Application Suite - Monitor Component
Maximo Application Suite - Predict Component
Telco Service Activator
Robotic Process Automation for Cloud Pak
Business Automation Insights
IBM Content Navigator
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Server Module
SUSE Manager Retail Branch Server
SUSE Manager Proxy Module
openSUSE Leap
IBM Tivoli Application Dependency Discovery Manager
Oracle WebCenter Sites
JBoss Enterprise Application Platform
IBM WebSphere Application Server Liberty
AMQ Streams
IBM WebSphere Application Server
IBM Cognos Controller
Financial Transaction Manager
IBM Qradar SIEM
IBM License Metric Tool
Event Streams
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Service Communication Proxy
image-sync-formula
inter-server-sync-debuginfo
inter-server-sync
jose4j
subscription-matcher
eap7-insights-java-client (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-ironjacamar (Red Hat package)
smdba
eap7-jboss-server-migration (Red Hat package)
eap7-jsoup (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap7-xalan-j2 (Red Hat package)
cobbler
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
mgr-daemon
uyuni-reportdb-schema
python3-uyuni-common-libs
supportutils-plugin-susemanager
release-notes-susemanager-proxy
release-notes-susemanager
spacewalk-config
susemanager-sync-data
spacewalk-client-setup
spacewalk-check
python3-spacewalk-check
spacewalk-client-tools
python3-spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-certs-tools
python3-spacewalk-certs-tools
susemanager-schema
susemanager-schema-utility
spacecmd
spacewalk-backend-xml-export-libs
spacewalk-backend
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-xmlrpc
spacewalk-backend-sql
spacewalk-backend-iss
spacewalk-backend-server
spacewalk-backend-config-files-common
spacewalk-backend-tools
spacewalk-backend-config-files-tool
spacewalk-backend-sql-postgresql
spacewalk-backend-app
spacewalk-backend-config-files
spacewalk-backend-applet
susemanager-tools
susemanager
spacewalk-base-minimal
spacewalk-base
spacewalk-html
spacewalk-base-minimal-config
uyuni-config-modules
susemanager-sls
spacewalk-java-lib
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
spacewalk-java
susemanager-docs_en-pdf
susemanager-docs_en
eap7-jbossws-cxf (Red Hat package)
eap7-hibernate-validator (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat OpenShift Serverless
Planning Analytics Local
Operational Decision Manager
IBM Cognos Analytics
IBM Cloud Pak for Multicloud Management
IBM Cloud Pak System
IBM InfoSphere Information Server
How to mitigate CVE-2023-51775
Install updates from vendor's website.
jose4j - update to 0.9.4
IBM MQ Operator - addressed in versions 9.3.0.20-r1, 9.4.0.0-r2
IBM Content Navigator - addressed in versions 3.0.15 IF009, 3.1.0 IF008 LA2, 3.2.0 IF004
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Tivoli Netcool Impact - update to 7.1.0.34
JBoss Enterprise Application Platform - update to 7.4.19
Maximo Application Suite - Visual Inspection Component - update to 9.0.3
IBM Security Verify Information Queue - update to 10.0.9
IBM Cognos Controller - update to 11.0.1.0.3
IBM WebSphere Application Server Liberty - update to 24.0.0.4
image-sync-formula - update to 0.1.1711646883.4a44375-150400.3.18.4
inter-server-sync-debuginfo - update to 0.3.3-150400.3.30.4
inter-server-sync - update to 0.3.3-150400.3.30.4
jose4j - update to 0.5.1-150400.3.9.4
subscription-matcher - update to 0.37-150400.3.22.4
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
Jazz for Service Management - update to 1.1.3.21
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.8
Log Analysis - update to 1.3.8
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.18-1.Final_redhat_00001.1.el7eap, 1.5.18-1.Final_redhat_00001.1.el8eap, 1.5.18-1.Final_redhat_00001.1.el9eap
smdba - update to 1.7.13-0.150400.4.12.4
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-39.Final_redhat_00039.1.el7eap, 1.10.0-39.Final_redhat_00039.1.el8eap, 1.10.0-39.Final_redhat_00039.1.el9eap
IBM Cloud Pak for Security - update to 1.11.2.0
IBM Process Mining - update to 1.15.0 IF004
eap7-jsoup (Red Hat package) - addressed in versions 1.15.4-1.redhat_00003.1.el7eap, 1.15.4-1.redhat_00003.1.el8eap, 1.15.4-1.redhat_00003.1.el9eap
Red Hat OpenShift Serverless - update to 1.33.0
PowerVM NovaLink - addressed in versions 2.0.3.1-240625, 2.1.1-240625, 2.2.1-240626
Planning Analytics Local - update to 2.0.9.20
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.el8eap, 2.0.15-1.Final_redhat_00001.1.el9eap
IBM Planning Analytics Workspace - update to 2.1.4
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
AMQ Streams - update to 2.5.2
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-37.redhat_00015.1.el7eap, 2.7.1-37.redhat_00015.1.el8eap, 2.7.1-37.redhat_00015.1.el9eap
Netezza Performance Server Replication Services - update to 3.0.5.0
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.4
cobbler - update to 3.3.3-150400.5.42.5
eap7-hal-console (Red Hat package) - addressed in versions 3.3.24-1.Final_redhat_00001.1.el7eap, 3.3.24-1.Final_redhat_00001.1.el8eap, 3.3.24-1.Final_redhat_00001.1.el9eap
Financial Transaction Manager - update to 4.0.6.0 iFix4
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.55-1.Final_redhat_00001.1.el7eap, 4.0.55-1.Final_redhat_00001.1.el8eap, 4.0.55-1.Final_redhat_00001.1.el9eap
mgr-daemon - update to 4.3.9-150400.3.15.5
uyuni-reportdb-schema - update to 4.3.10-150400.3.15.6
python3-uyuni-common-libs - update to 4.3.10-150400.3.18.4
supportutils-plugin-susemanager - update to 4.3.11-150400.3.21.4
release-notes-susemanager-proxy - update to 4.3.12-150400.3.82.3
release-notes-susemanager - update to 4.3.12-150400.3.108.2
spacewalk-config - update to 4.3.13-150400.3.15.5
susemanager-sync-data - update to 4.3.17-150400.3.25.4
spacewalk-client-setup - update to 4.3.19-150400.3.27.5
spacewalk-check - update to 4.3.19-150400.3.27.5
python3-spacewalk-check - update to 4.3.19-150400.3.27.5
spacewalk-client-tools - update to 4.3.19-150400.3.27.5
python3-spacewalk-client-setup - update to 4.3.19-150400.3.27.5
python3-spacewalk-client-tools - update to 4.3.19-150400.3.27.5
spacewalk-certs-tools - update to 4.3.23-150400.3.28.5
python3-spacewalk-certs-tools - update to 4.3.23-150400.3.28.5
susemanager-schema - update to 4.3.25-150400.3.39.5
susemanager-schema-utility - update to 4.3.25-150400.3.39.5
spacecmd - update to 4.3.27-150400.3.36.5
spacewalk-backend-xml-export-libs - update to 4.3.28-150400.3.41.7
spacewalk-backend - update to 4.3.28-150400.3.41.7
spacewalk-backend-package-push-server - update to 4.3.28-150400.3.41.7
spacewalk-backend-iss-export - update to 4.3.28-150400.3.41.7
spacewalk-backend-xmlrpc - update to 4.3.28-150400.3.41.7
spacewalk-backend-sql - update to 4.3.28-150400.3.41.7
spacewalk-backend-iss - update to 4.3.28-150400.3.41.7
spacewalk-backend-server - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files-common - update to 4.3.28-150400.3.41.7
spacewalk-backend-tools - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files-tool - update to 4.3.28-150400.3.41.7
spacewalk-backend-sql-postgresql - update to 4.3.28-150400.3.41.7
spacewalk-backend-app - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files - update to 4.3.28-150400.3.41.7
spacewalk-backend-applet - update to 4.3.28-150400.3.41.7
susemanager-tools - update to 4.3.35-150400.3.48.6
susemanager - update to 4.3.35-150400.3.48.6
spacewalk-base-minimal - update to 4.3.38-150400.3.42.6
spacewalk-base - update to 4.3.38-150400.3.42.6
spacewalk-html - update to 4.3.38-150400.3.42.6
spacewalk-base-minimal-config - update to 4.3.38-150400.3.42.6
uyuni-config-modules - update to 4.3.41-150400.3.47.6
susemanager-sls - update to 4.3.41-150400.3.47.6
spacewalk-java-lib - update to 4.3.73-150400.3.79.1
spacewalk-taskomatic - update to 4.3.73-150400.3.79.1
spacewalk-java-postgresql - update to 4.3.73-150400.3.79.1
spacewalk-java-config - update to 4.3.73-150400.3.79.1
spacewalk-java - update to 4.3.73-150400.3.79.1
susemanager-docs_en-pdf - update to 4.3-150400.9.56.4
susemanager-docs_en - update to 4.3-150400.9.56.4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.6
IBM Match 360 - update to 5.0.1
IBM Spectrum Control - update to 5.4.12
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.12-1.Final_redhat_00001.1.el7eap, 5.4.12-1.Final_redhat_00001.1.el8eap, 5.4.12-1.Final_redhat_00001.1.el9eap
eap7-hibernate-validator (Red Hat package) - addressed in versions 6.0.23-2.SP1_redhat_00001.1.el7eap, 6.0.23-2.SP1_redhat_00001.1.el8eap, 6.0.23-2.SP1_redhat_00001.1.el9eap
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
eap7-wildfly (Red Hat package) - addressed in versions 7.4.19-1.GA_redhat_00002.1.el7eap, 7.4.19-1.GA_redhat_00002.1.el8eap, 7.4.19-1.GA_redhat_00002.1.el9eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.16
Storage Protect Operations Center - update to 8.1.23
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.14
IBM WebSphere Application Server - addressed in versions 8.5.5.26, 9.0.5.20
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.15, 8.7.9
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
IBM Maximo Application Suite - addressed in versions 8.10.14, 8.11.11
Maximo Application Suite - Predict Component - update to 9.0.0
IBM TXSeries for Multiplatforms - update to 9.1.0.3
IBM MQ - addressed in versions 9.1.0.22, 9.2.0.26, 9.3.0.20, 9.4
Telco Service Activator - update to 9.1.31
IBM License Metric Tool - update to 9.2.36
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix26, 11.1.0.0 ifix19
IBM CICS TX Standard - update to 11.1.0.0 ifix19
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
Event Streams - update to 11.4.0
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 21.0.3.32, 23.0.2.4, 24.0.0-IF001
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
Business Automation Insights - update to 23.0.2.0.6
IBM Observability with Instana - update to 268
IBM MQ Operator - addressed in versions 9.3.0.20-r1, 9.4.0.0-r2
IBM Content Navigator - addressed in versions 3.0.15 IF009, 3.1.0 IF008 LA2, 3.2.0 IF004
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Tivoli Netcool Impact - update to 7.1.0.34
JBoss Enterprise Application Platform - update to 7.4.19
Maximo Application Suite - Visual Inspection Component - update to 9.0.3
IBM Security Verify Information Queue - update to 10.0.9
IBM Cognos Controller - update to 11.0.1.0.3
IBM WebSphere Application Server Liberty - update to 24.0.0.4
image-sync-formula - update to 0.1.1711646883.4a44375-150400.3.18.4
inter-server-sync-debuginfo - update to 0.3.3-150400.3.30.4
inter-server-sync - update to 0.3.3-150400.3.30.4
jose4j - update to 0.5.1-150400.3.9.4
subscription-matcher - update to 0.37-150400.3.22.4
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
Jazz for Service Management - update to 1.1.3.21
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.8
Log Analysis - update to 1.3.8
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.18-1.Final_redhat_00001.1.el7eap, 1.5.18-1.Final_redhat_00001.1.el8eap, 1.5.18-1.Final_redhat_00001.1.el9eap
smdba - update to 1.7.13-0.150400.4.12.4
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-39.Final_redhat_00039.1.el7eap, 1.10.0-39.Final_redhat_00039.1.el8eap, 1.10.0-39.Final_redhat_00039.1.el9eap
IBM Cloud Pak for Security - update to 1.11.2.0
IBM Process Mining - update to 1.15.0 IF004
eap7-jsoup (Red Hat package) - addressed in versions 1.15.4-1.redhat_00003.1.el7eap, 1.15.4-1.redhat_00003.1.el8eap, 1.15.4-1.redhat_00003.1.el9eap
Red Hat OpenShift Serverless - update to 1.33.0
PowerVM NovaLink - addressed in versions 2.0.3.1-240625, 2.1.1-240625, 2.2.1-240626
Planning Analytics Local - update to 2.0.9.20
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.el8eap, 2.0.15-1.Final_redhat_00001.1.el9eap
IBM Planning Analytics Workspace - update to 2.1.4
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
AMQ Streams - update to 2.5.2
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-37.redhat_00015.1.el7eap, 2.7.1-37.redhat_00015.1.el8eap, 2.7.1-37.redhat_00015.1.el9eap
Netezza Performance Server Replication Services - update to 3.0.5.0
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.4
cobbler - update to 3.3.3-150400.5.42.5
eap7-hal-console (Red Hat package) - addressed in versions 3.3.24-1.Final_redhat_00001.1.el7eap, 3.3.24-1.Final_redhat_00001.1.el8eap, 3.3.24-1.Final_redhat_00001.1.el9eap
Financial Transaction Manager - update to 4.0.6.0 iFix4
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.55-1.Final_redhat_00001.1.el7eap, 4.0.55-1.Final_redhat_00001.1.el8eap, 4.0.55-1.Final_redhat_00001.1.el9eap
mgr-daemon - update to 4.3.9-150400.3.15.5
uyuni-reportdb-schema - update to 4.3.10-150400.3.15.6
python3-uyuni-common-libs - update to 4.3.10-150400.3.18.4
supportutils-plugin-susemanager - update to 4.3.11-150400.3.21.4
release-notes-susemanager-proxy - update to 4.3.12-150400.3.82.3
release-notes-susemanager - update to 4.3.12-150400.3.108.2
spacewalk-config - update to 4.3.13-150400.3.15.5
susemanager-sync-data - update to 4.3.17-150400.3.25.4
spacewalk-client-setup - update to 4.3.19-150400.3.27.5
spacewalk-check - update to 4.3.19-150400.3.27.5
python3-spacewalk-check - update to 4.3.19-150400.3.27.5
spacewalk-client-tools - update to 4.3.19-150400.3.27.5
python3-spacewalk-client-setup - update to 4.3.19-150400.3.27.5
python3-spacewalk-client-tools - update to 4.3.19-150400.3.27.5
spacewalk-certs-tools - update to 4.3.23-150400.3.28.5
python3-spacewalk-certs-tools - update to 4.3.23-150400.3.28.5
susemanager-schema - update to 4.3.25-150400.3.39.5
susemanager-schema-utility - update to 4.3.25-150400.3.39.5
spacecmd - update to 4.3.27-150400.3.36.5
spacewalk-backend-xml-export-libs - update to 4.3.28-150400.3.41.7
spacewalk-backend - update to 4.3.28-150400.3.41.7
spacewalk-backend-package-push-server - update to 4.3.28-150400.3.41.7
spacewalk-backend-iss-export - update to 4.3.28-150400.3.41.7
spacewalk-backend-xmlrpc - update to 4.3.28-150400.3.41.7
spacewalk-backend-sql - update to 4.3.28-150400.3.41.7
spacewalk-backend-iss - update to 4.3.28-150400.3.41.7
spacewalk-backend-server - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files-common - update to 4.3.28-150400.3.41.7
spacewalk-backend-tools - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files-tool - update to 4.3.28-150400.3.41.7
spacewalk-backend-sql-postgresql - update to 4.3.28-150400.3.41.7
spacewalk-backend-app - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files - update to 4.3.28-150400.3.41.7
spacewalk-backend-applet - update to 4.3.28-150400.3.41.7
susemanager-tools - update to 4.3.35-150400.3.48.6
susemanager - update to 4.3.35-150400.3.48.6
spacewalk-base-minimal - update to 4.3.38-150400.3.42.6
spacewalk-base - update to 4.3.38-150400.3.42.6
spacewalk-html - update to 4.3.38-150400.3.42.6
spacewalk-base-minimal-config - update to 4.3.38-150400.3.42.6
uyuni-config-modules - update to 4.3.41-150400.3.47.6
susemanager-sls - update to 4.3.41-150400.3.47.6
spacewalk-java-lib - update to 4.3.73-150400.3.79.1
spacewalk-taskomatic - update to 4.3.73-150400.3.79.1
spacewalk-java-postgresql - update to 4.3.73-150400.3.79.1
spacewalk-java-config - update to 4.3.73-150400.3.79.1
spacewalk-java - update to 4.3.73-150400.3.79.1
susemanager-docs_en-pdf - update to 4.3-150400.9.56.4
susemanager-docs_en - update to 4.3-150400.9.56.4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.6
IBM Match 360 - update to 5.0.1
IBM Spectrum Control - update to 5.4.12
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.12-1.Final_redhat_00001.1.el7eap, 5.4.12-1.Final_redhat_00001.1.el8eap, 5.4.12-1.Final_redhat_00001.1.el9eap
eap7-hibernate-validator (Red Hat package) - addressed in versions 6.0.23-2.SP1_redhat_00001.1.el7eap, 6.0.23-2.SP1_redhat_00001.1.el8eap, 6.0.23-2.SP1_redhat_00001.1.el9eap
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
eap7-wildfly (Red Hat package) - addressed in versions 7.4.19-1.GA_redhat_00002.1.el7eap, 7.4.19-1.GA_redhat_00002.1.el8eap, 7.4.19-1.GA_redhat_00002.1.el9eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.16
Storage Protect Operations Center - update to 8.1.23
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.14
IBM WebSphere Application Server - addressed in versions 8.5.5.26, 9.0.5.20
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.15, 8.7.9
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
IBM Maximo Application Suite - addressed in versions 8.10.14, 8.11.11
Maximo Application Suite - Predict Component - update to 9.0.0
IBM TXSeries for Multiplatforms - update to 9.1.0.3
IBM MQ - addressed in versions 9.1.0.22, 9.2.0.26, 9.3.0.20, 9.4
Telco Service Activator - update to 9.1.31
IBM License Metric Tool - update to 9.2.36
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix26, 11.1.0.0 ifix19
IBM CICS TX Standard - update to 11.1.0.0 ifix19
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
Event Streams - update to 11.4.0
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 21.0.3.32, 23.0.2.4, 24.0.0-IF001
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
Business Automation Insights - update to 23.0.2.0.6
IBM Observability with Instana - update to 268
External References
Related Security Bulletins
- Resource exhaustion in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty
- Resource exhaustion in IBM Buinses Automation Workflow
- Resource exhaustion in IBM WebSphere Remote Server
- Resource exhaustion in IBM Jazz for Service Management
- Resource exhaustion in IBM Tivoli Netcool/OMNIbus WebGUI
- Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
- Multiple vulnerabilities in IBM Security Verify Governance, Identity Manager
- Multiple vulnerabilities in IBM Observability with Instana
- Resource exhaustion in IBM Tivoli Composite Application Manager for Application Diagnostics
- Resource exhaustion in IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM)
- Multiple vulnerabilities in IBM Cloud Pak for Business Automation
- SUSE update for Maintenance update for SUSE Manager 4.3 Release Notes
- SUSE update for Maintenance update for SUSE Manager 4.3: Server, Proxy and Retail Branch Server
- Multiple vulnerabilities in IBM CICS TX Standard
- Multiple vulnerabilities in IBM CICS TX Advanced
- Multiple vulnerabilities in IBM TXSeries for Multiplatforms
- Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
- Resource exhaustion in IBM Engineering Lifecycle Engineering product
- Multiple vulnerabilities in IBM QRadar SIEM
- Multiple vulnerabilities in IBM Operational Decision Manager
- Multiple vulnerabilities in IBM Log Analysis
- Resource exhaustion in IBM Tivoli System Automation Application Manager
- Resource exhaustion in IBM Intelligent Operations Center
- Multiple vulnerabilities in IBM Rational ClearCase and IBM DevOps Code ClearCase
- Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
- Resource exhaustion in IBM Rational ClearQuest
- Multiple vulnerabilities in Red Hat OpenShift Serverless 1
- Multiple vulnerabilities in IBM License Metric Tool
- Multiple vulnerabilities in IBM MQ
- Multiple vulnerabilities in IBM Business Automation Insights
- Multiple vulnerabilities in IBM Tivoli Monitoring
- Resource exhaustion in IBM Asset Data Dictionary Component
- Resource exhaustion in IBM Maximo Application Suite
- Resource exhaustion in IBM WebSphere Application Server Liberty
- Multiple vulnerabilities in IBM InfoSphere Information Server
- Resource exhaustion in IBM Tivoli Netcool Impact
- Resource exhaustion in IBM PowerVM Novalink
- Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
- Multiple vulnerabilities in IBM OpenPages
- Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
- Resource exhaustion in InfoSphere Master Data Management
- Resource exhaustion in IBM Event Streams
- Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
- Multiple vulnerabilities in Oracle Communications EAGLE Element Management System
- Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
- Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
- Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite
- Resource exhaustion in IBM Maximo Application Suite Predict Component
- Resource exhaustion in IBM Maximo Application Suite - Monitor Component
- Multiple vulnerabilities in IBM Security Verify Information Queue
- Multiple vulnerabilities in IBM Spectrum Control
- Resource exhaustion in IBM Maximo Asset Management
- Resource exhaustion in IBM Maximo Application Suite - Manage Component
- Resource exhaustion in IBM Match 360
- Multiple vulnerabilities in Planning Analytics Local
- Multiple vulnerabilities in IBM Planning Analytics Workspace
- Resource exhaustion in IBM Watson Discovery for IBM Cloud Pak for Data
- Multiple vulnerabilities in IBM Application Performance Management
- Multiple vulnerabilities in IBM Cloud Pak for Business Automation
- Multiple vulnerabilities in AMQ Streams 2.5
- Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
- Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
- Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
- Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
- Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
- Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
- Resource exhaustion in Oracle WebCenter Sites
- Resource exhaustion in IBM SPSS Collaboration and Deployment Services
- IBM Maximo Application Suite - Visual Inspection Component update for jose4j
- Multiple vulnerabilities in IBM Cognos Analytics
- IBM Sterling B2B Integrator update for WebSphere Application Server
- Multiple vulnerabilities in IBM SPSS Analytic Server
- Multiple vulnerabilities in IBM Business Monitor
- IBM Cloud Pak System update for jose4j
- Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift
- Multiple vulnerabilities in IBM Process Mining
- Multiple vulnerabilities in IBM Cognos Controller
- Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
- Multiple vulnerabilities in HPE Unified OSS Console Assurance Monitoring (UOCAM)
- Multiple vulnerabilities in IBM Cloud Pak for Security
- Multiple vulnerabilities in IBM MQ Operator
- Multiple vulnerabilities in IBM Watson Knowledge Catalog
- Multiple vulnerabilities in HPE Telco Service Activator
- Multiple vulnerabilities in IBM Netezza Performance Server Replication Services
- Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
- IBM Content Navigator update for jose4j