SB2024091734 - Multiple vulnerabilities in IBM Maximo Application Suite
Published: September 17, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Unprotected storage of credentials (CVE-ID: CVE-2019-11250)
The vulnerability allows a local user to gain access to other users' credentials.
The vulnerability exists due Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.
2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2020-8565)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to authorization and bearer tokens will be written to log files if the logging level is set to at least 9. A local user can read the log files and gain access to sensitive data.
3) Resource exhaustion (CVE-ID: CVE-2019-11253)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when processing YAML or JSON data in Kubernetes API server. A remote attacker can pass a malicious file to the API server and consume excessive memory and CPU resources, leading to a denial of service (DoS) attack.
Note, this vulnerability can be exploited by a remote non-authenticated attacker in Kubernetes versions prior to 1.14.0 due to default RBAC policy.
Remediation
Install update from vendor's website.