IBM Business Automation Workflow: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 7.5
  CVE-2023-31582

  jose4j uses weak cryptographic algorithm

  jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

  org.bitbucket.b_c:jose4j libjose4j-java libjose4j-java Debian Ubuntu Maven
  Oct 24, 2023
• High 7.5
  CVE-2023-43642

  Missing upper bound check on chunk length in snappy-java

  snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bou…

  xerial snappy-java druid snappy-java Debian Ubuntu Wolfi Maven
  Sep 25, 2023
• High 7.3
  CVE-2023-26159

  Follow Redirects improperly handles URLs in the url.parse() function

  Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacke…

  lerna kubeflow-centraldashboard python-tensorboard js-jquery Debian Ubuntu Azure Linux Wolfi npm
  Jan 2, 2024
• Medium 6.5
  CVE-2023-45857 Public exploit

  Axios Cross-Site Request Forgery Vulnerability

  An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

  node-axios node-axios axios Debian Ubuntu npm
  Nov 8, 2023

Revision history

1. 2024-02-01 #1

   Initiale Fassung

References

• IBM Security Bulletin vom 2024-02-01
  https://www.ibm.com/support/pages/node/7114422
• IBM Security Bulletin vom 2024-02-01
  https://www.ibm.com/support/pages/node/7114423
• IBM Security Bulletin vom 2024-02-01
  https://www.ibm.com/support/pages/node/7114425