Lucene search

IBME722DBF27AD69CE11EBB3777B5BC147A55684039881D8C225B643FE94A354600

HistoryNov 17, 2022 - 6:01 p.m.

Security Bulletin: Rational Asset Analyzer is vulnerable to denial of service due to GraphQL Java (CVE-2022-37734)

2022-11-1718:01:44

www.ibm.com

ibm websphere application server liberty

rational asset analyzer

graphql java

denial of service

cve-2022-37734

uncontrolled resource consumption

mpgraphql

directive overloading

vulnerability

fix

upgrade

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

58.9%

JSON

Summary

There is a vulnerability in IBM WebSphere Application Server Liberty used by Rational Asset Analyzer. This vulnerability is located in the GraphQL Java library used by IBM WebSphere Application Server Liberty, with the mpGraphQL-1.0 or mpGraphQL-2.0 feature enabled. This has been addressed.

Vulnerability Details

CVEID:CVE-2022-37734
**DESCRIPTION:**GraphQL Java is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw. By sending a specially-crafted request using Directive overloading, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235781 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
Rational Asset Analyzer (RAA)	6.1.0.0 - 6.1.0.23

Remediation/Fixes

Apply the corresponding fix from FIX Central. Note the release date of 2022/11/16

Windows Version	Fix Central
z/OS Version	Fix Central

IBM strongly recommends addressing the vulnerability now by upgrading.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmrational_asset_analyzerMatch6.1.0.0

ibmrational_asset_analyzerMatch6.1.0.23

VendorProductVersionCPE
ibmrational_asset_analyzer6.1.0.0cpe:2.3:a:ibm:rational_asset_analyzer:6.1.0.0:*:*:*:*:*:*:*
ibmrational_asset_analyzer6.1.0.23cpe:2.3:a:ibm:rational_asset_analyzer:6.1.0.23:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	rational_asset_analyzer	6.1.0.0	cpe:2.3:a:ibm:rational_asset_analyzer:6.1.0.0:::::::*
ibm	rational_asset_analyzer	6.1.0.23	cpe:2.3:a:ibm:rational_asset_analyzer:6.1.0.23:::::::*