SB2024052416 - Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024052416

SB2024052416 - Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Published: May 24, 2024

Security Bulletin ID SB2024052416
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Missing Encryption of Sensitive Data (CVE-ID: CVE-2023-45285)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to a fallback to insecure git. Using "go get" to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and  git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. OPROXY=off).


2) Link following (CVE-ID: CVE-2023-4759)

The vulnerability allows a remote attacker to overwrite files on the system.

The vulnerability exists due to an insecure link following. A remote attacker can place a specially crafted symbolic link into the repository, trick the victim into cloning it and overwrite arbitrary files on the system.


3) Insufficient verification of data authenticity (CVE-ID: CVE-2024-24557)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient verification of data authenticity. A remote attacker can poison victim´s cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.


Remediation

Install update from vendor's website.

References