Medium WID-SEC-2024-0423 6 CVEs

IBM Business Automation Workflow: Mehrere Schwachstellen

Published Feb 19, 2024 · Updated Feb 19, 2024 · de-DE

Vendor: IBM Product: Business Automation Workflow Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.

Product

IBM Business Automation Workflow ist eine Lösung zur Automatisierung von Arbeitsabläufen.

Vulnerabilities 6

Critical 9.8

CVE-2023-29824

A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor a…

scipy scipy Debian PyPI

Jul 6, 2023
High 7.5

CVE-2023-29159

Starlette has Path Traversal vulnerability in StaticFiles

Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.

encode starlette starlette starlette Debian Ubuntu PyPI

Jun 1, 2023
High 7.5

CVE-2023-44271

Pillow Denial of Service vulnerability

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textleng…

pillow pillow pillow pillow-python2 Debian Ubuntu PyPI

Nov 3, 2023
Medium 5.9

CVE-2023-43804 Public exploit

`Cookie` HTTP header isn't stripped on cross-origin redirects

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Oct 4, 2023
Medium 5.5

CVE-2023-25399

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() …

scipy scipy scipy Debian Ubuntu PyPI

Jul 5, 2023
Medium 5.3

CVE-2023-27043

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wro…

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine Wolfi

Apr 18, 2023

Revision history

2024-02-19 #1
Initiale Fassung

References

IBM Security Bulletin vom 2024-02-19
https://www.ibm.com/support/pages/node/7120748