IBM Business Automation Workflow: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 9.8
  CVE-2022-46337

  Apache Derby: LDAP injection vulnerability in authenticator

  A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the …

  Apache Software Foundation Apache Derby druid spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven
  Nov 20, 2023
• Medium 5.3
  CVE-2023-51074

  json-path Out-of-bounds Write vulnerability

  json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

  trino trino-plugin-opensearch trino-plugin-lakehouse trino-plugin-pinot Ubuntu Wolfi Maven
  Dec 27, 2023

Revision history

1. 2024-03-17 #2

   Neue Updates von IBM aufgenommen

2. 2024-03-03 #1

   Initiale Fassung

References

• IBM Security Bulletin vom 2024-03-03
  https://www.ibm.com/support/pages/security-bulletin-denial-service-vulnerability-affect-ibm-business-automation-workflow-event-emitters-cve-2023-51074
• IBM Security Bulletin vom 2024-03-03
  https://www.ibm.com/support/pages/node/7129317
• IBM Security Bulletin vom 2024-03-03
  https://www.ibm.com/support/pages/node/7129249
• IBM Security Bulletin 7142190 vom 2024-03-15
  https://www.ibm.com/support/pages/node/7142190