Uncontrolled Memory Allocation in Braces - CVE-2024-4068

Vulnerability identifier: #VU92405

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-4068

CWE-ID: CWE-789

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. A remote attacker can send "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Braces
Software Support app (Android)
Software Support App (iOS)
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
DB2 Data Management Console
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Fusion Data Foundation
Data Product Hub
Db2 Big SQL
Rational Developer for i
IBM Security Verify Information Queue
Cognos Analytics Mobile (Android)
Cognos Analytics Mobile (iOS)
Storage Copy Data Management
QRadar Deployment Intelligence App
QRadar Assistant
Security QRadar EDR
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Cognos Dashboards on Cloud Pak for Data
QRadar Log Source Management App
Maximo Application Suite - Monitor Component
Storage Protect Plus Server
IBM Event Endpoint Management
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Fedora
Python 3 Module
openSUSE Leap
IBM Concert Software
Use Case Manager App
Confluence Data Center
IBM Maximo Application Suite
IBM Observability with Instana
IBM Cloud Pak for Security
IBM Fusion HCI
IBM Cloud Transformation Advisor
QRadar User Behavior Analytics
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
Bitbucket Data Center
IBM QRadar WinCollect Agent
IBM Cloud Pak for Business Automation
JBoss Enterprise Application Platform
Bitbucket Server
eap7-insights-java-client (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-jsoup (Red Hat package)
yarnpkg
eap7-undertow-jastow (Red Hat package)
eap7-xalan-j2 (Red Hat package)
nodejs-nodemon
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
pgadmin4-doc
pgadmin4-web-uwsgi
pgadmin4-web
pgadmin4
pgadmin4-debuginfo
eap7-jbossws-cxf (Red Hat package)
eap7-hibernate-validator (Red Hat package)
eap7-wildfly (Red Hat package)
pgadmin4-desktop
system-user-pgadmin
pgadmin4-cloud
Migration Toolkit for Containers
IBM DataPower Gateway
Planning Analytics Local
IBM Cloud Pak System
IBM Security QRadar Analyst Workflow
IBM App Connect Enterprise

Install updates from vendor's website.

Braces - update to 3.0.3
IBM Concert Software - update to 2.0.0
Software Support app (Android) - update to 2.0.0
Software Support App (iOS) - update to 2.0.0
Use Case Manager App - update to 3.10.0
Data Virtualization (DV) on Cloud Pak for Data (CPD) - addressed in versions 2.2.8, 3.1.0
Watson Query on Cloud Pak for Data - update to 2.2.8
DB2 Data Management Console - update to 3.1.13.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
Data Product Hub - update to 5.0.1
JBoss Enterprise Application Platform - update to 7.4.19
Db2 Big SQL - addressed in versions 7.6.8, 7.7.3
Confluence Data Center - addressed in versions 7.19.29, 8.5.17, 8.9.8, 9.1.1
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
IBM Security Verify Information Queue - update to 10.0.9
IBM Observability with Instana - update to 274
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
Cognos Analytics Mobile (Android) - update to 1.1.20
Cognos Analytics Mobile (iOS) - update to 1.1.20
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.18-1.Final_redhat_00001.1.el7eap, 1.5.18-1.Final_redhat_00001.1.el8eap, 1.5.18-1.Final_redhat_00001.1.el9eap
Migration Toolkit for Containers - update to 1.8.4
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-39.Final_redhat_00039.1.el7eap, 1.10.0-39.Final_redhat_00039.1.el8eap, 1.10.0-39.Final_redhat_00039.1.el9eap
IBM Cloud Pak for Security - update to 1.11.2.0
eap7-jsoup (Red Hat package) - addressed in versions 1.15.4-1.redhat_00003.1.el7eap, 1.15.4-1.redhat_00003.1.el8eap, 1.15.4-1.redhat_00003.1.el9eap
yarnpkg - update to 1.22.22-5.el9
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.el8eap, 2.0.15-1.Final_redhat_00001.1.el9eap
Planning Analytics Local - update to 2.1.5
Storage Copy Data Management - update to 2.2.27.0
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-37.redhat_00015.1.el7eap, 2.7.1-37.redhat_00015.1.el8eap, 2.7.1-37.redhat_00015.1.el9eap
IBM Fusion HCI - update to 2.9.0
IBM Security QRadar Analyst Workflow - update to 2.33.1
QRadar Deployment Intelligence App - update to 3.0.14
nodejs-nodemon - addressed in versions 3.1.9-3.fc40, 3.1.9-3.fc41, 3.1.9-4.fc42
eap7-hal-console (Red Hat package) - addressed in versions 3.3.24-1.Final_redhat_00001.1.el7eap, 3.3.24-1.Final_redhat_00001.1.el8eap, 3.3.24-1.Final_redhat_00001.1.el9eap
QRadar Assistant - update to 3.8.0
IBM Cloud Transformation Advisor - update to 3.10.0
Security QRadar EDR - update to 3.12.9
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.55-1.Final_redhat_00001.1.el7eap, 4.0.55-1.Final_redhat_00001.1.el8eap, 4.0.55-1.Final_redhat_00001.1.el9eap
QRadar User Behavior Analytics - update to 4.1.17
DB2 on Cloud Pak for Data - update to 4.8.8
DB2 Warehouse on Cloud Pak for Data - update to 4.8.8
Cognos Dashboards on Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
pgadmin4-doc - addressed in versions 4.30-150300.3.18.1, 8.5-150600.3.6.1
pgadmin4-web-uwsgi - addressed in versions 4.30-150300.3.18.1, 8.5-150600.3.6.1
pgadmin4-web - update to 4.30-150300.3.18.1
pgadmin4 - addressed in versions 4.30-150300.3.18.1, 8.5-150600.3.6.1
pgadmin4-debuginfo - update to 4.30-150300.3.18.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.0.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0.3
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.12-1.Final_redhat_00001.1.el7eap, 5.4.12-1.Final_redhat_00001.1.el8eap, 5.4.12-1.Final_redhat_00001.1.el9eap
eap7-hibernate-validator (Red Hat package) - addressed in versions 6.0.23-2.SP1_redhat_00001.1.el7eap, 6.0.23-2.SP1_redhat_00001.1.el8eap, 6.0.23-2.SP1_redhat_00001.1.el9eap
QRadar Log Source Management App - update to 7.0.11
eap7-wildfly (Red Hat package) - addressed in versions 7.4.19-1.GA_redhat_00002.1.el7eap, 7.4.19-1.GA_redhat_00002.1.el8eap, 7.4.19-1.GA_redhat_00002.1.el9eap
pgadmin4 - update to 7.8-7.fc39
pgadmin4-desktop - update to 8.5-150600.3.6.1
system-user-pgadmin - update to 8.5-150600.3.6.1
pgadmin4-cloud - update to 8.5-150600.3.6.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.15, 8.11.12, 9.0.4
Bitbucket Server - update to 8.19.25
Bitbucket Data Center - update to 8.19.25
IBM QRadar WinCollect Agent - update to 10.1.11
Storage Protect Plus Server - update to 10.1.16.3
IBM DataPower Gateway - addressed in versions 10.5.0.13, 10.6.0.1
IBM Event Endpoint Management - update to 11.2.1
IBM App Connect Enterprise - update to 12.0.12.3
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF034, 23.0.2-IF006

• https://github.com/micromatch/braces/issues/35
• https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
• https://github.com/micromatch/braces/pull/37
• https://github.com/micromatch/braces/pull/40
• https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff

• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Fedora 39 update for pgadmin4
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM QRadar WinCollect Agent
• Uncontrolled Memory Allocation in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in Use Case Manager App
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in IBM QRadar Assistant
• Uncontrolled memory allocation in IBM DataPower Gateway
• Multiple vulnerabilities in IBM Storage Protect Plus
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• IBM Watson Assistant for IBM Cloud Pak for Data update for Node.js
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Fedora EPEL 9 update for yarnpkg
• Uncontrolled memory allocation in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Cloud Pak System
• SUSE update for pgadmin4
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (Android)
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (iOS)
• Confluence Data Center update for braces
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Fusion HCI
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Software Support app
• Fedora 40 update for nodejs-nodemon
• Fedora 42 update for nodejs-nodemon
• Fedora 41 update for nodejs-nodemon
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data
• SUSE update for pgadmin4
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM Storage Fusion Data Foundation update for Node.js braces
• SUSE update for pgadmin4
• SUSE update for pgadmin4
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM Maximo Application Suite
• Bitbucket Data Center and Server update for Braces
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• IBM Db2 Big SQL on Cloud Pak for Data update for NPM package braces
• Multiple vulnerabilities in IBM DB2 Data Management Console
• IBM Rational Developer for i update for braces