SB2024101006 - Multiple vulnerabilities in IBM Data Product Hub
Published: October 10, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-39338)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42459)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error when handling EDDSA signatures. A remote attacker can bypass signature-based security checks.3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42460)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error when handling ECDSA signatures. A remote attacker can bypass signature-based security checks.4) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42461)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error when handling BER-encoded ECDSA signatures. A remote attacker can bypass signature-based security checks.
Remediation
Install update from vendor's website.