High WID-SEC-2024-2102 4 CVEs

IBM InfoSphere Information Server: Mehrere Schwachstellen

Published Sep 10, 2024 · Updated Sep 10, 2024 · de-DE

Vendor: IBM Product: InfoSphere Information Server Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial of Service zu verursachen.

Product

IBM InfoSphere Information Server ist eine Softwareplattform zur Integration heterogener Daten.

Vulnerabilities 4

High 7.5

CVE-2024-39689 Public exploit

Certifi removes GLOBALTRUST root certificate

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI

Jul 5, 2024
High 7.5

CVE-2024-6162

Undertow: url-encoded request path information can be broken on ajp-listener

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to inc…

Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Maven

Jun 20, 2024
Medium 6.2

CVE-2024-5569

Denial of Service via crafted zip file in jaraco/zipp

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile …

jaraco jaraco/zipp kubeflow-pipelines-apiserver tensorflow Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Jul 9, 2024
Medium 4.4

CVE-2024-37891

Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…

urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI

Jun 17, 2024

Revision history

2024-09-10 #1
Initiale Fassung

References

IBM Security Bulletin 7167750 vom 2024-09-10
https://www.ibm.com/support/pages/node/7167750
IBM Security Bulletin 7167750 vom 2024-09-10
https://www.ibm.com/support/pages/node/7167753
IBM Security Bulletin 7167750 vom 2024-09-10
https://www.ibm.com/support/pages/node/7167752
IBM Security Bulletin 7167750 vom 2024-09-10
https://www.ibm.com/support/pages/node/7166639