IBM Storage Scale Multiple CVEs Advisory (CVE-2025-22868/22869/1137)

Critical Vulnerability Information Vulnerability Overview Multiple vulnerabilities affecting IBM Storage Scale cloudkit and CES S3 have been resolved. Vulnerability Details 1. CVEID: CVE-2025-22868 - Description: Attackers can cause unexpected memory consumption during parsing by passing maliciously formatted tokens. - CVSS Base Score: 7.5 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) 2. CVEID: CVE-2025-22869 - Description: An SSH server implementing file transfer protocol may be vulnerable to denial-of-service attacks if the client performs slow or incomplete key exchange. - CVSS Base Score: 7.5 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) 3. CVEID: CVE-2025-1137 - Description: Under specific configurations, IBM Storage Scale may allow authenticated users to execute privileged commands due to improper input neutralization. - CVSS Base Score: 7.5 - CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Affected Products and Versions IBM Storage Scale - 5.1.7.0 - 5.1.9.8 (CVE-2025-22868, CVE-2025-22869) - 5.2.2.0 - 5.2.2.1 (CVE-2025-1137) Remediation Storage Scale 5.1: Upgrade to version 5.1.9.9 or later. Storage Scale 5.2.2.0 - 5.2.2.1: Upgrade to version 5.2.3.0 or later. Workarounds and Mitigations No specific workarounds or mitigations mentioned. Additional Information Release Date: May 9, 2025 Related Links: IBM Secure Engineering Web Portal, IBM Product Security Incident Response Blog

Goal Reached Thanks to every supporter — we hit 100%!

IBM Storage Scale Multiple CVEs Advisory (CVE-2025-22868/22869/1137)