IBMCD5A8CD591B1BD6FF8BF1066C19AAF4B5C244B276B37512C741A09B501BEE739Security Bulletin: Vulnerability in the Golang language affects IBM Event Streams (CVE-2022-3064)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.005 Low
EPSS
Percentile
76.8%
Summary
This security vulnerability affects Golang that is used by IBM Event Streams.
Vulnerability Details
CVEID:CVE-2022-3064
**DESCRIPTION:**Go-Yaml package is vulnerable to a denial of service, caused by an unbounded alias chasing flaw. By using a specially-crafted YAML file, a remote attacker could exploit this vulnerability to consume significant CPU or memory resources.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/243452 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Event Streams | 10.0.0, 10.1.0, 10.2.0-eus, 10.2.1-eus, 10.3.0, 10.3.1, 10.4.0, 10.5.0, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.1.0, 11.1.1, 11.1.2, 11.1.3 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading
Upgrade to IBM Event Streams 11.1.4 by following the upgrading and migrating documentation.
Workarounds and Mitigations
None
Affected configurations
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.005 Low
EPSS
Percentile
76.8%