Security Bulletin: IBM PowerVM Novalink is vulnerable because RESTEasy could allow a local authenticated attacker to gain elevated privileges on the system, caused by the creation of insecure temp files in the File. (CVE-2023-0482)

Summary

IBM PowerVM Novalink is vulnerable because RESTEasy could allow a local authenticated attacker to gain elevated privileges on the system, caused by the creation of insecure temp files in the File.createTempFile() used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.

Vulnerability Details

CVEID:CVE-2023-0482
**DESCRIPTION:**RESTEasy could allow a local authenticated attacker to gain elevated privileges on the system, caused by the creation of insecure temp files in the File.createTempFile() used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/246304 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading based on the table below.

Update to pvm-novalink-2.0.1-230626

or

Update to pvm-novalink-2.0.3.1.1-230726

or

Update to pvm-novalink-2.1.1-230725

PowerVM Novalink| 2.0.1|

Update to pvm-novalink-2.0.1-230626

or

Update to pvm-novalink-2.0.3.1.1-230726

or

Update to pvm-novalink-2.1.1-230725

PowerVM Novalink| 2.0.2|

Update to pvm-novalink-2.0.3.1.1-230726

or

Update to pvm-novalink-2.1.1-230725

PowerVM Novalink| 2.0.2.1|

Update to pvm-novalink-2.0.3.1.1-230726

or

Update to pvm-novalink-2.1.1-230725

PowerVM Novalink| 2.0.3|

Update to pvm-novalink-2.0.3.1.1-230726

or

Update to pvm-novalink-2.1.1-230725

PowerVM Novalink| 2.0.3.1|

Update to pvm-novalink-2.0.3.1.1-230726

or

Update to pvm-novalink-2.1.1-230725

PowerVM Novalink| 2.1.0| Update to pvm-novalink-2.1.1-230725
PowerVM Novalink| 2.1.1| Update to pvm-novalink-2.1.1-230725

Workarounds and Mitigations

None