Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMC0BCD9A9BF939458EA2B5D67C3BDE1D9300E1237CE433F37F5BD2E10E60A9568
HistoryFeb 07, 2024 - 3:45 p.m.

Security Bulletin: IBM DataPower Gateway vulnerable to unauthorized access in Redis

2024-02-0715:45:50
www.ibm.com
40
ibm datapower gateway
redis
vulnerability
fix
unauthorized access
race condition
umask
cve-2023-45145
security
b2b
rate-limiting
apar
it45065

CVSS3

3.6

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

6.4

Confidence

Low

EPSS

0

Percentile

10.5%

JSON

Summary

Redis is used in gateway peering, B2B and rate-limiting. IBM has updated Redis to address the vulnerability.

Vulnerability Details

CVEID:CVE-2023-45145
**DESCRIPTION:**Redis could allow a local authenticated attacker to bypass security restrictions, caused by a race condition when a permissive umask(2) is used during startup. By sending a specially crafted request, an attacker could exploit this vulnerability to establish an unauthorized connection.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/269075 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM DataPower Gateway 10.5 CD 10.5.0-10.5.2
IBM DataPower Gateway 10.0.1 10.0.1.0-10.0.1.16
IBM DataPower Gateway 10.5.0 10.5.0.0-10.5.0.8

Remediation/Fixes

Affected Product Fixed in version APAR
IBM DataPower Gateway 10.5 CD 10.5.3 IT45065
IBM DataPower Gateway 10.0.1 10.0.1.17 IT45065
IBM DataPower Gateway 10.5.0 10.5.0.9 IT45065

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmdatapower_gatewayMatch10.5
OR
ibmdatapower_gatewayMatch10.5.0
OR
ibmdatapower_gatewayMatch10.0.1
VendorProductVersionCPE
ibmdatapower_gateway10.5cpe:2.3:a:ibm:datapower_gateway:10.5:*:*:*:*:*:*:*
ibmdatapower_gateway10.5.0cpe:2.3:a:ibm:datapower_gateway:10.5.0:*:*:*:*:*:*:*
ibmdatapower_gateway10.0.1cpe:2.3:a:ibm:datapower_gateway:10.0.1:*:*:*:*:*:*:*

Related

osv 10
alpinelinux 1
nessus 23
openvas 12
cvelist 1
prion 1
freebsd 1
redos 1
veracode 1
fedora 3
cve 1
cbl_mariner 1
mageia 1
ubuntucve 1
debiancve 1
redhatcve 1
nvd 1
debian 2
photon 3
ubuntu 1
ibm 3
gentoo 1
oracle 1
osv
osv
BIT-redis-2023-45145
2024-03-06 11:03:25
redis - security update
2023-10-23 00:00:00
BIT-keydb-2023-45145
2024-08-22 19:22:46
alpinelinux
alpinelinux
CVE-2023-45145
2023-10-18 21:15:09
nessus
nessus
Fedora 39 : redis (2023-fd75e4f307)
2023-11-07 00:00:00
Photon OS 5.0: Redis PHSA-2023-5.0-0125
2024-07-23 00:00:00
Fedora 37 : redis (2023-8a9087f089)
2023-10-26 00:00:00
openvas
openvas
Redis Unix Socket Permission Access Bypass Vulnerability (GHSA-ghmp-889m-7cvx)
2023-10-18 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:4376-1)
2023-11-07 00:00:00
openSUSE: Security Advisory for redis (SUSE-SU-2023:4290-1)
2024-03-04 00:00:00
cvelist
cvelist
CVE-2023-45145 Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.
2023-10-18 20:17:08
prion
prion
Race condition
2023-10-18 21:15:00
freebsd
freebsd
redis -- Possible bypassing Unix socket permissions
2023-10-18 00:00:00
redos
redos
ROS-20231030-06
2023-10-30 00:00:00
veracode
veracode
Race Condition
2023-10-20 05:33:12
fedora
fedora
[SECURITY] Fedora 38 Update: redis-7.0.14-1.fc38
2023-10-27 01:26:50
[SECURITY] Fedora 39 Update: redis-7.2.2-1.fc39
2023-11-03 19:01:14
[SECURITY] Fedora 37 Update: redis-7.0.14-1.fc37
2023-10-27 01:12:03
cve
cve
CVE-2023-45145
2023-10-18 21:15:09
cbl_mariner
cbl_mariner
CVE-2023-45145 affecting package redis for versions less than 6.2.14-1
2023-11-08 02:07:28
mageia
mageia
Updated redis package fixes a security vulnerability
2023-10-24 20:25:46
ubuntucve
ubuntucve
CVE-2023-45145
2023-10-18 00:00:00
debiancve
debiancve
CVE-2023-45145
2023-10-18 21:15:09
redhatcve
redhatcve
CVE-2023-45145
2023-10-18 23:57:26
nvd
nvd
CVE-2023-45145
2023-10-18 21:15:09
debian
debian
[SECURITY] [DLA 3627-1] redis security update
2023-10-23 13:01:00
[SECURITY] [DSA 5610-1] redis security update
2024-01-29 21:15:54
photon
photon
Moderate Photon OS Security Update - PHSA-2023-5.0-0125
2023-10-25 00:00:00
Critical Photon OS Security Update - PHSA-2023-4.0-0497
2023-10-25 00:00:00
Important Photon OS Security Update - PHSA-2023-3.0-0673
2023-10-26 00:00:00
ubuntu
ubuntu
Redis vulnerabilities
2023-12-05 00:00:00
ibm
ibm
Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in multiple Open-Source Software (OSS) components
2024-08-15 00:11:25
Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift
2024-05-23 18:42:48
Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management
2024-02-28 21:30:18
gentoo
gentoo
Redis: Multiple Vulnerabilities
2024-08-07 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00

CVSS3

3.6

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

6.4

Confidence

Low

EPSS

0

Percentile

10.5%

JSON
Related for C0BCD9A9BF939458EA2B5D67C3BDE1D9300E1237CE433F37F5BD2E10E60A9568
osv10alpinelinux1nessus23openvas12cvelist1prion1freebsd1redos1veracode1fedora3cve1cbl_mariner1mageia1ubuntucve1debiancve1redhatcve1nvd1debian2photon3ubuntu1ibm3gentoo1oracle1