Security Bulletin: IBM Maximo Application Suite uses dnspython-2.3.0-py3-none-any.whl which is vulnerable to CVE-2023-29483.

2024-09-1307:11:22

www.ibm.com

ibm maximo application suite

dnspython-2.3.0-py3

cve-2023-29483

denial of service

vulnerability

remedy

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

AI Score

6.6

Confidence

High

JSON

Summary

IBM Maximo Application Suite uses dnspython-2.3.0-py3-none-any.whl which is vulnerable to CVE-2023-29483. This bulletin contains information regarding the vulnerability and its fixture.

Vulnerability Details

CVEID:CVE-2023-29483
**DESCRIPTION:**Dnspython is vulnerable to a denial of service, caused by a flaw in stub resolver when a bad-in-some-way response arrives before a legitimate one on the UDP port dnspython is using for that query. By sending a specially crafted query, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/285000 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Maximo Application Suite	9.0
IBM Maximo Application Suite	8.11
IBM Maximo Application Suite	8.10

Remediation/Fixes

Remediated Product(s)	Version(s)
IBM Maximo Application Suite	9.0.2
IBM Maximo Application Suite	8.11.14
IBM Maximo Application Suite	8.10.16

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmaximo_application_suiteMatch9.0

ibmmaximo_application_suiteMatch8.11

ibmmaximo_application_suiteMatch8.10

VendorProductVersionCPE
ibmmaximo_application_suite9.0cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*
ibmmaximo_application_suite8.11cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*
ibmmaximo_application_suite8.10cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	maximo_application_suite	9.0	cpe:2.3:a:ibm:maximo_application_suite:9.0:::::::*
ibm	maximo_application_suite	8.11	cpe:2.3:a:ibm:maximo_application_suite:8.11:::::::*
ibm	maximo_application_suite	8.10	cpe:2.3:a:ibm:maximo_application_suite:8.10:::::::*