SB2025070708 - Multiple vulnerabilities in IBM Business Automation Manager Open Editions

Description

This security bulletin contains information about 25 secuirty vulnerabilities.

1) Deserialization of Untrusted Data (CVE-ID: CVE-2025-27818)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote user can set the sasl.jaas.config property for connector's Kafka clients to 'com.sun.security.auth.module.LdapLoginModule' through various override properties (producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config). This configuration enables the server to connect to an attacker's LDAP server and deserialize the LDAP response, potentially leading to the execution of java deserialization gadget chains on the Kafka connect server. 

2) Information disclosure (CVE-ID: CVE-2024-11736)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to the application discloses values of environment variables via user-configurable URLs. A remote user can configure backchannel logout URLs or admin URLs with placeholders like ${env.VARNAME} or ${PROPNAME} and gain access to sensitive information.

3) Input validation error (CVE-ID: CVE-2024-9666)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of HTTP proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.

4) Inefficient regular expression complexity (CVE-ID: CVE-2025-25289)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions in the processing of HTTP request headers. A remote attacker can send an authorization header containing an excessively long sequence of spaces followed by a newline and "@" to exploit inefficient regular expression processing and leading to excessive resource consumption.

5) Inefficient regular expression complexity (CVE-ID: CVE-2025-25288)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack when calling `octokit.paginate.iterator()`. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

6) Inefficient regular expression complexity (CVE-ID: CVE-2025-25285)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

7) Inefficient regular expression complexity (CVE-ID: CVE-2025-25290)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. A remote attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability.

8) Resource exhaustion (CVE-ID: CVE-2025-2240)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when calling metrics URI. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

9) Resource exhaustion (CVE-ID: CVE-2024-47554)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling untrusted input passed to the org.apache.commons.io.input.XmlStreamReader class. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

10) Improper authorization (CVE-ID: CVE-2025-41232)

The vulnerability allows a remote attacker to compromise the affected application.

The vulnerability exists due to an error in Spring Security Aspects, that may not correctly locate method security annotations on private methods. A remote non-authenticated attacker can bypass authorization checks and gain unauthorized access to the application. 

The vulnerability affects system that:

1. use @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
2. have Spring Security method annotations on a private method

11) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2025-27817)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in Apache Kafka Client. The application accepts configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

12) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2025-27152)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

13) Improper handling of case sensitivity (CVE-ID: CVE-2025-46701)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to an error when handling URLs on a case insensitive filesystem with security constraints configured for the <code>pathInfo</code> component of a URL that mapped to the CGI servlet. A remote attacker can bypass imposed security constraints via a specially crafted URL.

14) Input validation error (CVE-ID: CVE-2025-31672)

The vulnerability allows a remote attacker to manipulate file parsing behavior.

The vulnerability stems from the way Apache POI handles zip entries in OOXML format files. When duplicate file names (including paths) exist within the zip structure, different products may select different zip entries with the same name, leading to inconsistent data interpretation. A remote attacker can manipulate file parsing behavior through specially crafted OOXML files containing ZIP entries with duplicate file names. This manipulation can result in inconsistent data processing across different systems, potentially leading to security issues and data integrity concerns.

15) Inefficient regular expression complexity (CVE-ID: CVE-2025-27789)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

16) Improper authorization (CVE-ID: CVE-2025-22223)

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to an error in @EnableMethodSecurity when locating method security annotations on parameterized types or methods. A remote non-authenticated attacker can bypass authorization process and gain access to sensitive information.

17) Incorrect Regular Expression (CVE-ID: CVE-2024-21538)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

18) Security features bypass (CVE-ID: CVE-2025-22228)

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to BCryptPasswordEncoder does not properly enforce maximum password length and will return "true" for passwords larger than 72 characters as long as the first 72 characters are the same. This can be used set weak passwords that can be easily brute-forced.

19) Insecure Temporary File (CVE-ID: CVE-2020-15250)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the application is using the test rule TemporaryFolder that stores sensitive information in temporary files in the system temporary directory, accessible by other system users. A local user can read temporary files and obtain sensitive information, related to the application.

20) Improper Authentication (CVE-ID: CVE-2025-49146)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). A remote attacker can intercept connections that users believed were protected by channel binding requirements.

21) Information disclosure (CVE-ID: CVE-2025-1247)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists in in Quarkus REST due to software leaks parameters between concurrent requests if endpoints use field injection without a CDI scope. A remote user can gain access to sensitive information.

22) Resource exhaustion (CVE-ID: CVE-2025-1634)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists in in the quarkus-resteasy extension due to application does not properly control consumption of internal resources when client requests with low timeouts are made. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.

23) Security features bypass (CVE-ID: CVE-2024-38820)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to String.toLowerCase() has some Locale dependent exceptions when handling case insensitive patterns in DataBinder. A remote attacker can bypass implemented security restrictions by passing specially crafted data to the application.

24) Security features bypass (CVE-ID: CVE-2025-22233)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to String.toLowerCase() has some Locale dependent exceptions when handling case insensitive patterns in DataBinder. A remote attacker can bypass implemented security restrictions by passing specially crafted data to the application.

Note, the vulnerability exists due to incomplete fix for #VU98795 (CVE-2024-38820).

25) Use of insufficiently random values (CVE-ID: CVE-2025-22150)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the application uses "Math.random()" from the fetch() function to choose the boundary for a "multipart/form-data" request. A remote attacker with ability to intercept traffic can tamper with the requests going to the backend APIs.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7238606