Security Bulletin: Vulnerability in Rational Change 5.3.2 Fix Pack 05 and earlier versions.

Summary

Vulnerability in the Apache Commons FileUpload before 1.5 and earlier component shipped with Rational Change may affect the security of the product.

Vulnerability Details

CVEID:CVE-2023-24998
**DESCRIPTION:**Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By sending a specially-crafted request with series of uploads, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/247895 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Upgrade to Rational Change 5.3.2.6 supporting Apache Commons FileUpload 1.5 from IBM Passport Advantage and apply it.

NOTE:

Download the Rational Change 5.3.2.6 installation image by referring to the installation platform and its part number in the following list:

• IBM Rational Change V5.3.2.6 Multi-platform Multilingual (CC5T0ML) - Windows and Linux included.

Workarounds and Mitigations

None.