SB2024090428 - Multiple vulnerabilities in IBM watsonx.data

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024090428

SB2024090428 - Multiple vulnerabilities in IBM watsonx.data

Published: September 4, 2024

Security Bulletin ID SB2024090428
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2020-8565)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to authorization and bearer tokens will be written to log files if the logging level is set to at least 9. A local user can read the log files and gain access to sensitive data.


2) Unprotected storage of credentials (CVE-ID: CVE-2019-11250)

The vulnerability allows a local user to gain access to other users' credentials.

The vulnerability exists due Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.


Remediation

Install update from vendor's website.

References