Security Bulletin: IBM Workload Automation affected by multiple vulnerabilities in RHEL (CVE-2023-32681, CVE-2022-48468)

Summary

IBM Workload Automation (container solution) is affectedby multiple vulnerabilities found in RHEL.

Vulnerability Details

CVEID:CVE-2023-32681
**DESCRIPTION:**python-requests could allow a remote attacker to obtain sensitive information, caused by the leaking of Proxy-Authorization headers to destination servers during redirects to an HTTPS origin. By persuading a victim to click on a specially crafted URL, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/256114 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N)

CVEID:CVE-2022-48468
**DESCRIPTION:**protobuf-c is vulnerable to a denial of service, caused by an integer overflow in pref_len. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253266 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

APAR IJ50049 has been opened to address the vulnerabilities in RHEL affecting IBM Workload Automation (container solution).
APAR IJ50049 is included in IBM Workload Automation 10.2.1 and IBM Workload Automation 10.1 FP4, available on Fix Central.

Workarounds and Mitigations

None