Medium WID-SEC-2023-2724 4 CVEs

IBM Integration Bus: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 22, 2023 · Updated Oct 22, 2023 · de-DE

Vendor: IBM Product: Integration Bus 10.1 - 10.1.0.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Integration Bus ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

IBM Integration Bus ist eine "lightweight" ESB, welche die Integration von SOAP oder non-SOAP Datenquellen von verschiedenen Plattformen ermöglicht.

Vulnerabilities 4

High 7.5

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a cl…

mosquitto mosquitto mosquitto Debian Ubuntu Alpine

Sep 1, 2023
Medium 5.9

CVE-2023-3635 Public exploit

Okio GzipSource unhandled exception Denial of Service

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

thingsboard-tb-node thingsboard-tb-mqtt-transport trino trino-plugin-opensearch Ubuntu Wolfi Maven

Jul 12, 2023
Medium 5.8

CVE-2023-0809

In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packe…

Eclipse Foundation Mosquitto mosquitto mosquitto Debian Ubuntu Alpine

Oct 2, 2023
Medium 5.8

CVE-2023-3592

In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains…

Eclipse Foundation Mosquitto mosquitto mosquitto Debian Ubuntu Alpine

Oct 2, 2023

Revision history

2023-10-22 #1
Initiale Fassung

References

IBM Security Bulletin: 7056518 vom 2023-10-22
https://www.ibm.com/support/pages/node/7056518
IBM Security Bulletin: 7056456 vom 2023-10-22
https://www.ibm.com/support/pages/node/7056456