Security Bulletin: IBM Event Streams is affected by GNU gettext vulnerability CVE-2018-18751

Summary

IBM Event Streams has addressed the following vulnerability

Vulnerability Details

CVEID:CVE-2018-18751
**DESCRIPTION:**GNU gettext is vulnerable to a denial of service, caused by a double free flaw in the default_add_message function in read-catalog.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 3.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/152105 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

Affected Products and Versions

2019.2.1

IBM Event Streams in IBM Cloud Pak for Integration

|

2019.2.2

IBM Event Streams in IBM Cloud Pak for Integration

|

2019.2.3

IBM Event Streams

|

2019.4.1

IBM Event Streams in IBM Cloud Pak for Integration

|

2019.4.1

Remediation/Fixes

Upgrade from IBM Event Streams 2019.2.1 to IBM Event Streams 2019.4.1 by downloading IBM Event Streams 2019.4.1 from IBM Passport Advantage.

Upgrade from IBM Event Streams 2019.4.1 to the latest Fix Pack.

Upgrade IBM Event Streams 2019.2.2, IBM Event Streams 2019.2.3 and IBM Event Streams 2019.4.1 in IBM Cloud Pak for Integration by downloading IBM Event Streams 2019.4.2 in IBM Cloud Pak for Integration 2020.2.1 from IBM Passport Advantage.

Workarounds and Mitigations

None