SB2024031236 - Multiple vulnerabilities in IBM Cloud Pak for Data System

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024031236

SB2024031236 - Multiple vulnerabilities in IBM Cloud Pak for Data System

Published: March 12, 2024 Updated: September 20, 2024

Security Bulletin ID SB2024031236
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2019-14322)

The vulnerability allows a remote attacker to access arbitrary files on the target system.

The vulnerability exists due to the "SharedDataMiddleware" mishandles drive names (such as C:) in Windows pathnames. A remote attacker can access arbitrary files on the target system.


2) Insufficient Entropy (CVE-ID: CVE-2019-14806)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.


Remediation

Install update from vendor's website.

References