Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to python vulnerability ( CVE-2022-40897 )

Summary

Python is used by IBM Cloud Pak for Data as part of the Ansible operator for installation.

Vulnerability Details

CVEID:CVE-2022-40897
**DESCRIPTION:**Pypa Setuptools is vulnerable to a denial of service, caused by improper input validation. By sending request with a specially crafted regular expression, an remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/243028 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Products/Versions guidance:

1. Use a table

2. Clearly identify the vulnerable products and associated component(s) when applicable** **

3. List out specific version numbers,do not use generic terms like “all” or “2.x.” for version information

Example:

Affected Product(s)|**Version(s)
**
—|—
IBM Cloud Pak for Data Scheduling| 4.6.0 - 4.7.4
|

Remediation/Fixes

Remediation/Fixes guidance:

IBM strongly recommends addressing the vulnerability now.

Workarounds and Mitigations

Workarounds/Mitigation guidance:

None