IBM0B158C9092DDB8D8F86AE54168154F5196D07243A87938B6C4F2CC7165776F20Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System (Sailfish)[CVE-2023-38408]
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.028 Low
EPSS
Percentile
90.6%
Summary
The OpenSSH package is used by IBM Integrated Analytics System. The IBM Integrated Analytics System has addressed the applicable CVE [CVE-2023-38408].
Vulnerability Details
CVEID:CVE-2023-38408
**DESCRIPTION:**OpenSSH could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the forwarded ssh-agent. By sending specially crafted requests, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261022 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Integrated Analytics System | 1.0.0.0 - 1.0.28.0 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading to latest version.
| Product | VRMF | Remediation/First Fix |
|---|---|---|
| IBM Integrated Analytics System | 7.9.23.08.SP21 | Link to Fix Central |
Please follow the steps given in release notes to upgrade the system with the above version.
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm integrated analytics system | eq | any |
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.028 Low
EPSS
Percentile
90.6%