Security Bulletin: A vulnerability has been identified in Apache Solr and Apache Zookeeper shipped with IBM Operations Analytics - Log Analysis (CVE-2023-26048)

Summary

There is a potential vulnerability in Eclipse Jetty that is used by Apache Solr and Apache ZooKeeper. This has been addressed

Vulnerability Details

CVEID:CVE-2023-26048
**DESCRIPTION:**Eclipse Jetty is vulnerable to a denial of service, caused by an out of memory flaw in the HttpServletRequest.getParameter() or HttpServletRequest.getParts() function. By sending a specially crafted multipart request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253356 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

Install Log Analysis 1.3.8 and upgrade to Log Analysis version 1.3.8 Fix Pack 1

You can download the release from Passport Advantage. Part number:
M0GJREN IBM Operations Analytics Log Analysis v1.3.8 Linux 64 bit
M0GJSEN IBM Operations Analytics Log Analysis v1.3.8 zLinux 64 bit
M0GJTEN IBM Operations Analytics Log Analysis v1.3.8 Power8 ppc64le

Download the 1.3.8-TIV-IOALA-FP1

Workarounds and Mitigations

None