Security Bulletin: A vulnerability in Microsoft .NET Core affects IBM Robotic Process Automation and may result in a bypass of security restrictions (CVE-2024-0056)

Summary

A vulnerability in Microsoft .NET Core affects IBM Robotic Process Automation resulting in a bypass of security restrictions. Microsoft .NET Core is used by IBM Robotic Process Automation as part of it’s development platform. This bulletin identifies the security fixes to apply to address the vulnerability.

Vulnerability Details

CVEID:CVE-2024-0056
**DESCRIPTION:**Microsoft NET Core and Visual Studio could allow a remote attacker to bypass security restrictions, caused by a flaw in the Data.SqlClient and System.Data.SqlClient SQL Data Provider components. An attacker could exploit this vulnerability to carry out a man-in-the middle attack, and decrypt and read or modify TLS traffic between the client and server.
CVSS Base score: 8.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/276204 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

IBM Robotic Process Automation for Cloud Pak

| 23.0.0 - 23.0.14| Update to 23.0.15 or higher using the following instructions.

Workarounds and Mitigations

None.