Security Bulletin: Python is vulnerable to CVE-2022-26488 used in IBM Maximo Application Suite

Summary

IBM Maximo Application Suite uses Python which is vulnerable to CVE-2022-26488

Vulnerability Details

CVEID:CVE-2022-26488
**DESCRIPTION:**Python could allow a local authenticated attacker to gain elevated privileges on the system, caused by an issue when the search path is inadequately secured. By sending a specially-crafted request to add user-writable directories to the system search path, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221120 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

Upgrade to version 8.6.4 or latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None