Lucene search

IBM45AB5E52C7049D43AF510E3D9B3484D6A8452798F85D470CA860CB100D7BE1ED

HistoryNov 03, 2022 - 8:52 a.m.

Security Bulletin: Vulnerability from Apache Xerces2 affect IBM Operations Analytics - Log Analysis (CVE-2022-23437)

2022-11-0308:52:15

www.ibm.com

cve-2022-23437

denial of service

log analysis

ibm operations analytics

upgrade fix

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.005

Percentile

76.1%

JSON

Summary

Apache Xerces2 Java XML Parser shipped with Log Analysis is vulnerable to denial of service

Vulnerability Details

CVEID:CVE-2022-23437
**DESCRIPTION:**Apache Xerces2 Java XML Parser is vulnerable to a denial of service, caused by an infinite loop in the XML parser. By persuading a victim to open a specially-crafted XML document payloads, a remote attacker could exploit this vulnerability to consume system resources for prolonged duration.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217982 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
Log Analysis	1.3.5.3
Log Analysis	1.3.6.0
Log Analysis	1.3.6.1
Log Analysis	1.3.7.0
Log Analysis	1.3.7.1
Log Analysis	1.3.7.2

Remediation/Fixes

Version	Fix details
IBM Operations Analytics - Log Analysis version 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2	Upgrade to Log Analysis version 1.3.7.2 Interim Fix 1. Download the 1.3.7.2-TIV-IOALA-IF001. For Log Analysis prior to 1.3.7.2, upgrade to 1.3.7-TIV-IOALA-FP2 before installing this fix.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsmartcloud_analytics_log_analysisMatch1.3.5.3

ibmsmartcloud_analytics_log_analysisMatch1.3.6.0

ibmsmartcloud_analytics_log_analysisMatch1.3.6.1

ibmsmartcloud_analytics_log_analysisMatch1.3.7.0

ibmsmartcloud_analytics_log_analysisMatch1.3.7.1

ibmsmartcloud_analytics_log_analysisMatch1.3.7.2

VendorProductVersionCPE
ibmsmartcloud_analytics_log_analysis1.3.5.3cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.5.3:*:*:*:*:*:*:*
ibmsmartcloud_analytics_log_analysis1.3.6.0cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.6.0:*:*:*:*:*:*:*
ibmsmartcloud_analytics_log_analysis1.3.6.1cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.6.1:*:*:*:*:*:*:*
ibmsmartcloud_analytics_log_analysis1.3.7.0cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.7.0:*:*:*:*:*:*:*
ibmsmartcloud_analytics_log_analysis1.3.7.1cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.7.1:*:*:*:*:*:*:*
ibmsmartcloud_analytics_log_analysis1.3.7.2cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.7.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	smartcloud_analytics_log_analysis	1.3.5.3	cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.5.3:::::::*
ibm	smartcloud_analytics_log_analysis	1.3.6.0	cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.6.0:::::::*
ibm	smartcloud_analytics_log_analysis	1.3.6.1	cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.6.1:::::::*
ibm	smartcloud_analytics_log_analysis	1.3.7.0	cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.7.0:::::::*
ibm	smartcloud_analytics_log_analysis	1.3.7.1	cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.7.1:::::::*
ibm	smartcloud_analytics_log_analysis	1.3.7.2	cpe:2.3:a:ibm:smartcloud_analytics_log_analysis:1.3.7.2:::::::*