SB2025062331 - Multiple vulnerabilities in IBM DevOps Release
Published: June 23, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Incorrect default permissions (CVE-ID: CVE-2024-46544)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to incorrect default permissions for the memory mapped file configured by the JkShmFile directive on Unix like systems. A local user can view or modify the contents of the shared memory containing mod_jk configuration and status information, which can lead to information disclosure or denial of service.
2) Improper Authentication (CVE-ID: CVE-2024-52316)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests. If Tomcat was configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not have failed, allowing the user to bypass the authentication process.
3) Resource management error (CVE-ID: CVE-2024-52317)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper management of internal resources when handling HTTP/2 responses, which causes request and/or response mix-up between users. A remote non-authenticated attacker can send a series of HTTP/2 requests and gain access to sensitive information.
4) Cross-site scripting (CVE-ID: CVE-2024-52318)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in generated JSPs. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Resource exhaustion (CVE-ID: CVE-2024-38286)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources during the TLS handshake process. A remote attacker can initiate multiple TLS connections, trigger memory exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.