IBM295D48FCD8CFAD96E73291F047FC2A0928B59C3AF2D8412BD5535B5EB7C3DF4FSecurity Bulletin: IBM DataPower Gateway vulnerable to DoS due to Node.js micromatch module (CVE-2024-4067)
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
IBM DataPower Gateway uses the micromatch module in its UI.
Vulnerability Details
CVEID:CVE-2024-4067
**DESCRIPTION:**Node.js micromatch module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in micromatch.braces() in index.js. By sending a specially crafted payload, a remote attacker could exploit this vulnerability to increase the consumption time until the application hangs or slows down.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/290676 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM DataPower Gateway 10.5.0 | 10.5.0.0 - 10.5.0.12 |
| IBM DataPower Gateway 10.6.0 | 10.6.0.0 |
Remediation/Fixes
| Affected Products | Fixed in version | APAR |
|---|---|---|
| IBM DataPower Gateway 10.5.0 | 10.5.0.13 | IT46692 |
| IBM DataPower Gateway 10.6.0 | 10.6.0.1 | IT46692 |
IBM strongly recommends addressing the vulnerability now
Workarounds and Mitigations
None
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | datapower_gateway | 10.5.0 | cpe:2.3:a:ibm:datapower_gateway:10.5.0:*:*:*:*:*:*:* |
| ibm | datapower_gateway | 10.6.0 | cpe:2.3:a:ibm:datapower_gateway:10.6.0:*:*:*:*:*:*:* |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L