IBM QRadar SIEM User Behavior Analytics: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• High 8.1
  CVE-2023-31484

  CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

  perl perl perl Debian Ubuntu Azure Linux
  Apr 28, 2023
• High 7.5
  CVE-2021-31684

  Out of bounds read in json-smart

  A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.

  druid thingsboard-tb-node thingsboard-tb-mqtt-transport celeborn-0.6 Debian Ubuntu Wolfi Maven
  Jun 1, 2021
• High 7.5
  CVE-2023-1370

  Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

  [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

  json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Mar 13, 2023
• Low 3.1
  CVE-2021-23445

  Cross-site Scripting (XSS)

  This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.

  reaper datatables.net datatables.js datatables.js Debian Ubuntu Azure Linux npm
  Sep 27, 2021
• Unscored —
  CVE-2021-4048

  An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10…

  openblas lapack lapack lapack Debian Ubuntu Azure Linux
  Dec 8, 2021

Revision history

1. 2024-02-01 #2

   Produkt angepasst

2. 2024-01-30 #1

   Initiale Fassung

References

• IBM Security Bulletin vom 2024-01-30
  https://www.ibm.com/support/pages/node/7112498