Resource exhaustion in jwx - CVE-2024-28122
Published: October 17, 2024
Vulnerability identifier: #VU98780
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-28122
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote privileged user with trusted public key can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio
Affected software
jwx
IBM Cloud Pak for Watson AIOps
IBM Maximo Application Suite
IBM Cloud Pak for Watson AIOps
IBM Maximo Application Suite
How to mitigate CVE-2024-28122
Install updates from vendor's website.
jwx - addressed in versions 1.2.29, 2.0.21
IBM Cloud Pak for Watson AIOps - update to 4.8.0
IBM Maximo Application Suite - addressed in versions 8.10.18, 8.11.15, 9.0.3, 9.1.0
IBM Cloud Pak for Watson AIOps - update to 4.8.0
IBM Maximo Application Suite - addressed in versions 8.10.18, 8.11.15, 9.0.3, 9.1.0