Security Bulletin: GNOME libxml2 vulnerability affects IBM Safer Payments (CVE-2023-29469)

Summary

Libxml2 is used by IBM Safer Payments as part of PMML models, external queries, and docx file templates for Outgoing Channel Configurations. This vulnerability has been addressed.

Vulnerability Details

CVEID:CVE-2023-29469
**DESCRIPTION:**GNOME libxml2 is vulnerable to a denial of service, caused by a double free flaw in the xmlDictComputeFastKey function due to hashing empty strings are not null-terminated. By persuading a victim to open a specially crafted XML content, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253143 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Update IBM Safer Payments to version 6.3.1.05, 6.4.2.04, 6.5.0.02, or higher.

Refer to the IBM Safer Payments documentation to download the updates.

Workarounds and Mitigations

Do not use PMML models, external queries, and docx file templates for Outgoing Channel Configurations