Lucene search

IBM03EA2F726296208B721100DD0A0B0F08937428A746324F0DE27D1E1384A3477B

HistoryJul 30, 2024 - 11:37 p.m.

Security Bulletin: IBM InfoSphere Information Server is affected by a denial of service vulnerability in JSON-java (CVE-2023-5072)

2024-07-3023:37:19

www.ibm.com

ibm

infosphere information server

denial of service

json-java

vulnerability

cve-2023-5072

fix

datadirect odbc drivers

openssl

aix

libc++.rte

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

Summary

A denial of service vulnerability in JSON-java used by IBM InfoSphere Information Server was addressed.

Vulnerability Details

CVEID:CVE-2023-5072
**DESCRIPTION:**JSON-java is vulnerable to a denial of service, caused by a bug in the parser. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268485 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
InfoSphere Information Server	11.7

Remediation/Fixes

Product	VRMF	APAR	Remediation
InfoSphere Information Server, InfoSphere Information Server on Cloud	11.7	DT381677	--Upgrade to DataDirect ODBC drivers version 8.0
--Use Technote to choose which OpenSSL version the drivers will use
--Use Technote to follow additional post installation configuration steps

--On AIX, update the libc++.rte. Details can be found in DT381677.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibminfosphere_information_serverMatch11.7

VendorProductVersionCPE
ibminfosphere_information_server11.7cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	infosphere_information_server	11.7	cpe:2.3:a:ibm:infosphere_information_server:11.7:::::::*

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

Related for 03EA2F726296208B721100DD0A0B0F08937428A746324F0DE27D1E1384A3477B