SB2024081544 - Multiple vulnerabilities in IBM Event Endpoint Management
Published: August 15, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2024-26308)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of memory when unpacking a broken Pack200 file. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Infinite loop (CVE-ID: CVE-2024-25710)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing a corrupt DUMP file. A remote attacker can consume all available system resources and cause denial of service conditions.
3) Cleartext storage of sensitive information (CVE-ID: CVE-2024-2700)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to cleartext storage of sensitive information in an environment variable. A local user can exploit this vulnerability to obtain local configuration properties information, and use this information to launch further attacks against the affected system.
4) Observable discrepancy (CVE-ID: CVE-2024-30171)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a possible timing based leakage in RSA based handshakes. A remote attacker can gain access to sensitive information.
5) Uncontrolled Memory Allocation (CVE-ID: CVE-2024-4068)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. A remote attacker can send "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
6) Information disclosure (CVE-ID: CVE-2024-29025)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in HttpPostRequestDecoder. A remote attacker can gain unauthorized access to sensitive information on the system.
7) Resource exhaustion (CVE-ID: CVE-2024-29857)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to library does not properly control consumption of internal resources when importing an EC certificate with specially crafted F2m parameters. A remote attacker can pass a specially crafted certificate to the application to trigger resource exhaustion and perform a denial of service (DoS) attack.
8) Resource exhaustion (CVE-ID: CVE-2024-1726)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to security checks in the RESTEasy Reactive implementation for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. A remote attacker can trigger resource exhaustion via specially crafted HTTP requests and perform a denial of service (DoS) attack.
9) Memory leak (CVE-ID: CVE-2024-1023)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak when using Netty FastThreadLocal data structures. A remote attacker can force the application to leak memory and perform denial of service attack.
10) Memory leak (CVE-ID: CVE-2024-1300)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak in TCP servers configured with TLS and SNI support. A remote attacker can pass a specially crafted certificate to the application and perform a denial of service (DoS) attack.
11) Infinite loop (CVE-ID: CVE-2024-30172)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the Ed25519 verification code. A remote attacker can pass a specially signature and public key to the application, consume all available system resources and cause denial of service conditions.
Remediation
Install update from vendor's website.