Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale Data Access Services (DAS) which can cause denial of service.

Summary

A security vulnerability has been identified in IBM Spectrum Scale Data Access Services (DAS) where Golang Go is vulnerable to denial of service. A fix for this vulnerability is available.

Vulnerability Details

CVEID:CVE-2022-41717
**DESCRIPTION:**Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in the Go server. By sending a specially-crafted keys, a remote attacker could exploit this vulnerability to cause excessive memory growth, and results in a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241875 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

For IBM Spectrum Scale Data Access Services (DAS) V5.1.5.0 - V5.1.6.0, install available V5.1.7.0 or newer by following the below IBM Documentation link:

h<https://www.ibm.com/docs/en/ssdas?topic=spectrum-scale-data-access-services-517&gt;

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=5.1.7&platform=All&function=all

Workarounds and Mitigations

None