IBM Cloud Pak for Business Automation Security Bulletin: Multiple CVEs including Container Escape and RCE

Critical Vulnerability Information Vulnerability Overview Announcement: This security announcement addresses multiple security vulnerabilities in IBM Cloud Pak for Business Automation versions 24.0.0-PF005 and 24.0.1-PF002. CVE IDs: CVE-2024-4332, CVE-2024-9342, CVE-2023-5470, CVE-2024-5561, CVE-2023-5778, CVE-2023-5838, CVE-2022-4218, CVE-2023-5715, CVE-2024-5114, CVE-2024-5044, CVE-2024-5233, CVE-2024-5227, CVE-2024-5002, CVE-2024-5120, CVE-2024-5057. Vulnerability Details CVE-2024-4332: - Description: In runc, an attacker can exploit a container escape vulnerability by creating hard links or symbolic links to files in any directory between two containers via shared volumes, potentially leading to container escape. - CVSS Score: Base score of 3.6, vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). CVE-2024-9342: - Description: In Eclipse IDE, certain functions do not check for NULL return values or memory allocation failures, leading to null pointer dereference crashes. - CVSS Score: Base score of 4.5, vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-5470: - Description: In OpenJDK, a buffer overflow vulnerability exists when input format strings and parameters exceed buffer size. - CVSS Score: Base score of 7.8, vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/M:H). CVE-2024-5561: - Description: In Apache Kafka, versions prior to 7.0.5 are vulnerable to a regular expression denial-of-service (DoS) attack. Attackers can consume CPU resources by sending large, complex regular expressions. - CVSS Score: Base score of 4.3, vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). CVE-2023-5778: - Description: The Babel compiler generates incorrect output when processing certain JavaScript code, potentially allowing authorized users to bypass server-side security checks. - CVSS Score: Base score of 6.5, vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2023-5838: - Description: IBM Business Automation Workflow allows authorized users to bypass server-side security checks, leading to service disruption. - CVSS Score: Base score of 6.5, vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2022-4218: - Description: Eclipse IDE allows a local authenticated attacker to access sensitive information such as passwords and credentials. - CVSS Score: Base score of 5.5, vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). CVE-2023-5715: - Description: Apache Kafka client uses hostname trust for browsers and node.js, potentially leading to cross-site request forgery (CSRF) attacks. - CVSS Score: Base score of 6.0, vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). CVE-2024-5114: - Description: Files or directories accessible to external entities may allow attackers to configure applications for custom behavior, including ConfProvider plugins to manipulate these configurations. - CVSS Score: Base score of 9.0, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:H/I:H/A:H). CVE-2024-5044: - Description: A deserialization vulnerability in Java SE components may lead to remote code execution (RCE) attacks. - CVSS Score: Base score of 4.8, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:L/I:L/A:N). CVE-2024-5233: - Description: A deserialization vulnerability in Java SE components may lead to remote code execution (RCE) attacks. - CVSS Score: Base score of 3.7, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:N/I:L/A:N). CVE-2024-5227: - Description: A deserialization vulnerability in Java SE components may lead to remote code execution (RCE) attacks. - CVSS Score: Base score of 3.7, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:N/I:L/A:N). CVE-2024-5002: - Description: A deserialization vulnerability in Java SE components may lead to remote code execution (RCE) attacks. - CVSS Score: Base score of 5.3, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:N/I:L/A:N). Affected Products and Versions Affected Product: IBM Cloud Pak for Business Automation Affected Versions: V24.0.1 - V24.0.1-PF001, V24.0.0 - V24.0.0-PF005, and earlier unsupported versions Remediation Patch: Apply security updates to version V24.0.1-PF002 or V24.0.0-PF006.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Cloud Pak for Business Automation Security Bulletin: Multiple CVEs including Container Escape and RCE