Security Bulletin: Docker based datastores for IBM Instana do not currently require authentication

Summary

Docker based datastores for IBM Instana do not currently require authentication. Due to this, an attacker with network or system access to the datastores could interrogate the datastores with read/write privileges (CVE-2023-27290).

Vulnerability Details

CVEID:CVE-2023-27290
**DESCRIPTION:**Docker based datastores for IBM Instana do not currently require authentication. Due to this, an attacker within the network or on the system could access the datastores with read/write access.
CVSS Base score: 9.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/248737 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

239-0 to 239-4
241-0 to 241-5
243-0 to 243-6
245-0 to 245-2

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Upgrading your Instana console:
<https://www.ibm.com/docs/en/instana-observability/current?topic=premises-operations-docker-based-instana&gt;
Use your appropriate package manager command to update to a desired package version of Instana console.

See the following example for Ubuntu:

To get the latest version, run the command as follows:

• sudo apt-get install instana-console

Workarounds and Mitigations

None