Skip to content
OpenAdvisories
High WID-SEC-2023-2935 2 CVEs

IBM Integration Bus: Mehrere Schwachstellen ermöglichen Denial of Service

Published Nov 15, 2023 · Updated Nov 15, 2023 · de-DE

Vendor: IBM Product: Integration Bus < 10.1.0.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Integration Bus ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

IBM Integration Bus ist eine "lightweight" ESB, welche die Integration von SOAP oder non-SOAP Datenquellen von verschiedenen Plattformen ermöglicht.

Vulnerabilities 2

  • High 7.5
    CVE-2023-43642

    Missing upper bound check on chunk length in snappy-java

    snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bou…

    xerial snappy-java druid snappy-java Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2023-5632

    Unconditionally adding an event to the epoll causes excessive CPU consumption

    In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of…

    Eclipse Foundation Mosquitto mosquitto Debian

Revision history

  1. #1

    Initiale Fassung

References