IBM App Connect Enterprise: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 7.8
  CVE-2022-48622

  In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory c…

  gdk-pixbuf gdk-pixbuf gdk-pixbuf gdk-pixbuf2 Debian Ubuntu Azure Linux Alpine
  Jan 26, 2024
• High 7.5
  CVE-2024-39689 Public exploit

  Certifi removes GLOBALTRUST root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

  certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI
  Jul 5, 2024
• Medium 5.6
  CVE-2024-35195

  Requests `Session` object does not verify requests after making first request with verify=False

  Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…

  psf requests katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 20, 2024
• Medium 4.8
  CVE-2023-23931

  Cipher.update_into can corrupt memory in pyca cryptography

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

  pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Feb 7, 2023

Revision history

1. 2024-08-12 #1

   Initiale Fassung

References

• IBM Security Bulletin vom 2024-08-12
  https://www.ibm.com/support/pages/node/7165266