IBM InfoSphere Information Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 8.8
  CVE-2022-4886

  Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

  Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

  Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  Oct 25, 2023
• High 8.0
  CVE-2023-46136 Public exploit

  Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

  Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Azure Linux Alpine Wolfi PyPI
  Oct 24, 2023
• High 7.6
  CVE-2023-5043 Public exploit

  Ingress nginx annotation injection causes arbitrary command execution

  Ingress nginx annotation injection causes arbitrary command execution.

  Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  Oct 25, 2023
• High 7.6
  CVE-2023-5044 Public exploit EPSS 54%

  Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

  Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

  Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  Oct 25, 2023

Revision history

1. 2024-11-18 #2

   Prüfung Produkteintragung

2. 2024-03-19 #1

   Initiale Fassung

References

• IBM Security Bulletin vom 2024-03-19
  https://www.ibm.com/support/pages/node/7116638
• IBM Security Bulletin vom 2024-03-19
  https://www.ibm.com/support/pages/node/7116639