Security Bulletin: IBM InfoSphere Information Server is affected by a denial of service vulnerability in Apache Kafka (CVE-2022-34917)

Summary

A denial of service vulnerability in Apache Kafka used by IBM InfoSphere Information Server was addressed.

Vulnerability Details

CVEID:CVE-2022-34917
**DESCRIPTION:**Apache Kafka is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to allocate large amounts of memory on brokers, and results in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/236498 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

--Apply IBM InfoSphere Information Server version 11.7.1.0
--Apply InfoSphere Information Server version 11.7.1.4
--Apply Information Server Kafka Connector security patch
--Apply Information Server security patch for Microservices tier
--Apply Information Server Common Event Framework security patch

Update on December 5, 2022: A new version (2) of the microservices tier patch is published to address another instance of Kafka. If the original version of the microservices tier patch was installed, download the new version and follow the instructions in the Readme file to apply.

Workarounds and Mitigations

None