IBMC18DDF1C38521A689F693C947284258C6B9726152AEEAB7676BFE13691C2182ESecurity Bulletin: Operations Dashboard is vulnerable to unspecified errors due to Go (CVE-2023-24532)
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
0.001 Low
EPSS
Percentile
39.8%
Summary
Operations Dashboard is vulnerable to unspecified errors due to Go (CVE-2023-24532) with details below.
Vulnerability Details
CVEID:CVE-2023-24532
**DESCRIPTION:**An unspecified error with return an incorrect result in the ScalarMult and ScalarBaseMult methods of the P256 Curve in Golang Go has an unknown impact and attack vector.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/249655 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Operations Dashboard | 2021.1.1 |
| 2021.2.1 | |
| 2021.3.1 | |
| 2021.4.1 | |
| 2022.2.1 |
Remediation/Fixes
Operations Dashboard in IBM Cloud Pak for Integration
Upgrade Operations Dashboard to 2022.2.1-10-lts using the Operator upgrade process described in the IBM Documentation
<https://www.ibm.com/docs/en/cloud-paks/cp-integration/2022.2?topic=capabilities-upgrading-integration-tracing>
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| operations dashboard | eq | 2021.1.12021.2.12021.3.12021.4.12022.2.1 |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
0.001 Low
EPSS
Percentile
39.8%