IBM DataPower Gateway: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 5.3
  CVE-2024-11738

  Rustls: rustls network-reachable panic in `acceptor::accept`

  A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.

  Red Hat Red Hat Trusted Artifact Signer rust rustls Ubuntu Azure Linux crates.io
  Dec 6, 2024
• Medium 5.1
  CVE-2024-12224

  idna accepts Punycode labels that do not produce any non-ASCII when decoded

  Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to anoth…

  servo rust-url linkerd2-controller linkerd2-tap Debian Ubuntu Alpine Wolfi crates.io
  May 30, 2025

Revision history

1. 2025-04-02 #1

   Initiale Fassung

References

• IBM Security Bulletin vom 2025-04-02
  https://www.ibm.com/support/pages/node/7229938
• IBM Security Bulletin vom 2025-04-02
  https://www.ibm.com/support/pages/node/7229939