Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data

1) Deserialization of Untrusted Data

EUVDB-ID: #VU95805

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-3568

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation within the load_repo_checkpoint() function of the TFPreTrainedModel() class. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Machine Learning Accelerator: before 5.0.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_watson_machine_learning_accelerator:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7182338

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU88977

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-25026

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling HTTP requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Machine Learning Accelerator: before 5.0.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_watson_machine_learning_accelerator:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7182338

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Data Handling

EUVDB-ID: #VU88540

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-20225

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The issue exists due to the way pip handles software versioning during installation with --extra-index-url option enabled, which results in the version with the highest version number to be installed, even if the user had intended to obtain a private package from a private index. A remote attacker compromise the repository and force installation of a malicious package.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Machine Learning Accelerator: before 5.0.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_watson_machine_learning_accelerator:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7182338

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource exhaustion

EUVDB-ID: #VU87180

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-28102

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing highly compressed data within the deserialize() function. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Machine Learning Accelerator: before 5.0.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_watson_machine_learning_accelerator:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7182338

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Code Injection

EUVDB-ID: #VU89149

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-34069

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the debugger. A remote attacker can trick the developer to interact with a domain and subdomain they control and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Machine Learning Accelerator: before 5.0.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_watson_machine_learning_accelerator:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7182338

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Path traversal

EUVDB-ID: #VU87689

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-27318

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences passed via the external_data field of the tensor proto. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Note, the vulnerability exists due to incomplete fix for #VU75176 (CVE-2022-25882).

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Machine Learning Accelerator: before 5.0.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_watson_machine_learning_accelerator:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7182338

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU72050

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-25193

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in hb-ot-layout-gsubgpos.hh. A remote attacker can use consecutive marks during the process of looking back for base glyphs when attaching marks and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Watson Machine Learning Accelerator: before 5.0.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_watson_machine_learning_accelerator:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7182338

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.