IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause.  IBM X-Force ID:  247864.

  

**Summary**

IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted SQL query using a LIMIT clause.

**Vulnerability Details**

**CVEID:**   CVE-2023-26021  
**DESCRIPTION:**   IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause.  
CVSS Base score: 7.5  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/247864 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

**Affected Products and Versions**

All fix pack levels of IBM Db2  V11.1, and V11.5 server editions on all platforms are affected. 

IBM Db2 V10.5 is not affected.

  

**Remediation/Fixes**

Customers running any vulnerable fixpack level of an affected Program,  v11.1 and V11.5, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent fixpack level for each impacted release:  V11.1.4 FP7, v11.5.7 and V11.5.8. They can be applied to any affected fixpack level of the appropriate release to remediate this vulnerability.

**Release**

**Fixed in fix pack**

**APAR**

**Download URL**

V11.1

TBD

DT160619

Special Build for V11.1.4 FP7:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Solaris 64-bit, SPARC  
Windows 32-bit, x86  
Windows 64-bit, x86

V11.5

TBD

DT160619

Special Build for V11.5.7:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Windows 32-bit, x86  
Windows 64-bit, x86

Special Build for V11.5.8:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Windows 32-bit, x86  
Windows 64-bit, x86

IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

**Workarounds and Mitigations**

None

**References**

Off

**Change History**

24 Apr 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\\/TPS"},"Product":{"code":"SSEPGG","label":"Db2 for Linux, UNIX and Windows"},"Component":"","Platform":\[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"},{"code":"PF027","label":"Solaris"}\],"Version":"11.5,11.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}\]

CVE-2023-26021: IBM® Db2® is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. (CVE-2023-26021)

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.  IBM X-Force ID:  244107.

  

**Summary**

This Security Bulletin addresses security vulnerabilities that have been remediated in IBM Aspera Connect 4.2.6 and IBM Aspera Cargo 4.2.6.

**Vulnerability Details**

**CVEID:**   CVE-2023-22862  
**DESCRIPTION:**   IBM Aspera Connect and IBM Aspera Cargo transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.  
CVSS Base score: 5.9  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/244107 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

**CVEID:**   CVE-2023-27285  
**DESCRIPTION:**   IBM Aspera Connect and IBM Aspera Cargo is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system.  
CVSS Base score: 8.4  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/248625 for the current score.  
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

**Affected Products and Versions**

**Affected Product(s)**

**Version(s)**

IBM Aspera Connect

0.0.0 - 4.2.5

IBM Aspera Cargo

0.0.0 - 4.2.5

**Remediation/Fixes**

It is recommended to apply the fix as soon as possible, see links in the table below.

**Product**

**Fixing VRM**

**Platform**

**Link to Fix**

IBM Aspera Connect

4.2.6

Linux

click here

IBM Aspera Connect

4.2.6

Mac OSX

click here

IBM Aspera Connect

4.2.6

Windows

click here

IBM Aspera Cargo

4.2.6

Linux

click here

IBM Aspera Cargo

4.2.6

Mac OSX

click here

IBM Aspera Cargo

4.2.6

Windows

click here

**Workarounds and Mitigations**

None

**References**

Off

**Acknowledgement**

**Change History**

2 June 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSQ65JJ","label":"IBM Aspera Enterprise"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"}\],"Version":"1.0.2","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSH2ME","label":"IBM Aspera Cargo"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"},{"code":"PF017","label":"Mac OS"}\],"Version":"4.2.6","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SS8NDZ","label":"IBM Aspera"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"}\],"Version":"1.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSHI916","label":"IBM Aspera Enterprise On Demand"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"}\],"Version":"1.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSXMX3","label":"IBM Aspera Connect"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"},{"code":"PF017","label":"Mac OS"},{"code":"PF033","label":"Windows"}\],"Version":"4.2.6","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSRFYR","label":"IBM Aspera on Demand"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"}\],"Version":"1.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}\]

CVE-2023-22862: Security Bulletin: IBM Aspera Connect and IBM Aspera Cargo has addressed multiple vulnerabilities (CVE-2023-22862, CVE-2023-27285)

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options.  IBM X-Force ID:  253202.

  

**Summary**

IBM® Db2® federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options.

**Vulnerability Details**

**CVEID:**   CVE-2023-30442  
**DESCRIPTION:**   IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options.  
CVSS Base score: 5.9  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253202 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

**Affected Products and Versions**

Affected Product(s)

Version(s)

Applicable Editions

IBM® Db2®

11.1.4.7

Server

IBM® Db2®

11.5.x

Server

All platforms are affected.

**Remediation/Fixes**

Customers running any vulnerable fixpack level of an affected Program, V11.1 and V11.5, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent fixpack level for each impacted release:  V11.1.4 FP7, and V11.5.8. They can be applied to any affected fixpack level of the appropriate release to remediate this vulnerability.

**Release**

**Fixed in fix pack**

**APAR**

**Download URL**

V11.1

TBD

DT187940

Special Build for V11.1.4 FP7:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Solaris 64-bit, SPARC  
Windows 32-bit, x86  
Windows 64-bit, x86

V11.5

TBD

DT187940

Special Build for V11.5.7:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Windows 32-bit, x86  
Windows 64-bit, x86

Special Build for V11.5.8:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Windows 32-bit, x86  
Windows 64-bit, x86

  

IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

**Workarounds and Mitigations**

None

**References**

Off

**Acknowledgement**

**Change History**

07 Jul 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\\/TPS"},"Product":{"code":"SSEPGG","label":"Db2 for Linux, UNIX and Windows"},"Component":"","Platform":\[{"code":"PF010","label":"HP-UX"},{"code":"PF033","label":"Windows"},{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"}\],"Version":"11.5,11.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}\]

CVE-2023-30442: IBM® Db2® federated server is vulnerable to a denial of service when using a specially crafted wrapper using certain options. (CVE-2023-30442)

IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  240905.

  

**Summary**

IBM Security Guardium has addressed these vulnerabilities.

**Vulnerability Details**

**CVEID:**   CVE-2022-43909  
**DESCRIPTION:**   IBM Security Guardium is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  
CVSS Base score: 4.6  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/240905 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

**CVEID:**   CVE-2022-21426  
**DESCRIPTION:**   An unspecified vulnerability in Java SE related to the JAXP component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.  
CVSS Base score: 5.3  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224714 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

**CVEID:**   CVE-2022-43907  
**DESCRIPTION:**   IBM Security Guardium could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  
CVSS Base score: 7.2  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/240901 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

**CVEID:**   CVE-2023-21830  
**DESCRIPTION:**   An unspecified vulnerability in Java SE related to the Serialization component could allow a remote attacker to cause a denial of service resulting in a low integrity impact using unknown attack vectors.  
CVSS Base score: 5.3  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/245038 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

**CVEID:**   CVE-2023-21843  
**DESCRIPTION:**   An unspecified vulnerability in Java SE related to the Sound component could allow a remote attacker to cause a denial of service resulting in a low integrity impact using unknown attack vectors.  
CVSS Base score: 3.7  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/245037 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

**Affected Products and Versions**

**Affected Product(s)**

**Version(s)**

IBM Security Guardium

11.4

**Remediation/Fixes**

**IBM encourages customers to update their systems promptly.**

**Workarounds and Mitigations**

None

**References**

Off

**Acknowledgement**

John Zuccato, Rodney Ryan, Chris Shepherd, Nathan Roane, Vince Dragnea, Troy Fisher, Gabor Minyo, Geoffrey Owden, and Ben Goodspeed from the IBM Security Ethical Hacking Team., John Zuccato, Rodney Ryan, Chris Shepherd, Nathan Roane, Vince Dragnea, T

**Change History**

23 Aug 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"}\],"Version":"11.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}\]

CVE-2022-43909: IBM Security Guardium is affected by multiple vulnerabilities

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query.  IBM X-Force ID:  254037.

  

**Summary**

IBM® Db2® is vulnerable to denial of service with a specially crafted query.

**Vulnerability Details**

**CVEID:**   CVE-2023-30991  
**DESCRIPTION:**   IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query.  
CVSS Base score: 7.5  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/254037 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

**Affected Products and Versions**

Affected Product(s)

Version(s)

Applicable Editions

IBM® Db2®

11.1.4.x

Server

IBM® Db2®

11.5.x

Server

All platforms are affected.

**Remediation/Fixes**

Customers running any vulnerable fixpack level of an affected Program, v11.1 and V11.5, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent fixpack level for each impacted release: V11.1.4 FP7, and V11.5.8. They can be applied to any affected fixpack level of the appropriate release to remediate this vulnerability.

**Release**

**Fixed in fix pack**

**APAR**

**Download URL**

V11.1

TBD

DT208544

Special Build for V11.1.4 FP7:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Solaris 64-bit, SPARC  
Windows 32-bit, x86  
Windows 64-bit, x86

V11.5

TBD

DT208544

Special Build for V11.5.0:

AIX 64-bit (for OS7.1)

Special Build for V11.5.7:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Windows 32-bit, x86  
Windows 64-bit, x86

Special Build for V11.5.8:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Windows 32-bit, x86  
Windows 64-bit, x86

IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

**Workarounds and Mitigations**

None

**References**

Off

**Acknowledgement**

**Change History**

06 Oct 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\\/TPS"},"Product":{"code":"SSEPGG","label":"Db2 for Linux, UNIX and Windows"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"},{"code":"PF002","label":"AIX"},{"code":"PF027","label":"Solaris"}\],"Version":"11.5,11.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}\]

CVE-2023-30991: IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2023-30991)

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE statement.  IBM X-Force ID:  261616.

  

**Summary**

IBM® Db2® is vulnerable to denial of service with a specially crafted ALTER TABLE statement.

**Vulnerability Details**

**CVEID:**   CVE-2023-38720  
**DESCRIPTION:**   IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted ALTER TABLE statement.  
CVSS Base score: 5.3  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261616 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

**Affected Products and Versions**

Affected Product(s)

Version(s)

Applicable Editions

IBM® Db2®

11.1.4.x

Server

IBM® Db2®

11.5.x

Server

All platforms are affected.

**Remediation/Fixes**

Customers running any vulnerable fixpack level of an affected Program, v11.1 and V11.5, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent fixpack level for each impacted release: V11.1.4 FP7, and V11.5.8. They can be applied to any affected fixpack level of the appropriate release to remediate this vulnerability.

**Release**

**Fixed in fix pack**

**APAR**

**Download URL**

V11.1

TBD

DT215667

Special Build for V11.1.4 FP7:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Solaris 64-bit, SPARC  
Windows 32-bit, x86  
Windows 64-bit, x86

V11.5

TBD

DT215667

Special Build for V11.5.0:

AIX 64-bit (for OS7.1)

Special Build for V11.5.7:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Windows 32-bit, x86  
Windows 64-bit, x86

Special Build for V11.5.8:

AIX 64-bit  
Linux 32-bit, x86-32  
Linux 64-bit, x86-64  
Linux 64-bit, POWER™ little endian  
Linux 64-bit, System z®, System z9® or zSeries®  
Windows 32-bit, x86  
Windows 64-bit, x86

IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

**Workarounds and Mitigations**

None

**References**

Off

**Acknowledgement**

**Change History**

06 Oct 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\\/TPS"},"Product":{"code":"SSEPGG","label":"Db2 for Linux, UNIX and Windows"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"},{"code":"PF002","label":"AIX"},{"code":"PF027","label":"Solaris"}\],"Version":"11.5,11.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}\]

CVE-2023-38720: IBM® Db2® is vulnerable to denial of service with a specially crafted ALTER TABLE statement (CVE-2023-38720)

C-MOR Video Surveillance version 5.2401 suffers from a reflective cross site scripting vulnerability.

Advisory ID:               SYSS-2024-020  
Product:                   C-MOR Video Surveillance  
Manufacturer:              za-internet GmbH  
Affected Version(s):       5.2401  
Tested Version(s):         5.2401  
Vulnerability Type:        Reflected Cross-Site Scripting (CWE-79)  
Risk Level:                Medium  
Solution Status:           Fixed  
Manufacturer Notification: 2024-04-05  
Solution Date:             2024-07-31  
Public Disclosure:         2024-09-04  
CVE Reference:             CVE-2024-45176  
Authors of Advisory:       Chris Beiter, Frederik Beimgraben,  
                            and Matthias Deeg

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The software product C-MOR is an IP video surveillance system.

The manufacturer describes the product as follows:

"With C-MOR video surveillance, it is possible to check your  
surveillance over network and the Internet. You can access the live  
view as well as previous recordings from any PC or mobile device.  
C-MOR is managed and controlled over the C-MOR web interface.  
IP settings, camera recording setup, user rights and so on are set  
over the web without the installation of any software on the  
client."[1]

Due to improper input validation, the C-MOR web interface is vulnerable  
to reflected cross-site scripting attacks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

By analyzing the C-MOR web interface, it was found that different  
functions are prone to reflected cross-site scripting attacks due to  
insufficient user input validation.

This kind of attack allows an attacker to send a manipulated link to  
an authenticated victim in order to execute arbitrary JavaScript code  
in the context of the victim's web browser.

Reflected cross-site scripting vulnerabilities were found in the  
following C-MOR scripts and exploited via different URL parameters,  
for instance the parameter "ujava":

* index-de.plm  
* list-timelapse.plm  
* list-motion.plm  
* setdelays.plm  
* show-movies.plm  
* show-movies-f.plm  
* uploadcambackup.plm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The following three sample attack vectors exemplarily demonstrate  
the found security issue.

1) index-de.plm

The following URL is an example of an attack vector exploiting a  
reflected cross-site scripting vulnerability via the URL parameter  
"ujava" of the web interface index page "index-de.plm":

https://<HOST>/index-de.pml?ujava="><script>alert("SySS XSS!")</script><z="

2) list-timelapse.plm

The following URL is an example of an attack vector exploiting a  
reflected cross-site scripting vulnerability in the page  
"list-timelapse.plm" via the URL parameter "days":

https://<HOST>/list-timelapse.pml?days=1100&cam=cam1"><script>alert("SySS   
XSS!")</script><z="

3) show-movies.plm

The following URL is an example of an attack vector exploiting a  
reflected cross-site scripting vulnerability in the page  
"show-movies.plm" via the URL parameter "days":

https://<HOST>/show-movies.pml?cam=cam1&days="><script>alert("SySS   
XSS!")</script><z="

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Install C-MOR Video Surveillance version 6.00PL1.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2024-04-05: Vulnerability reported to manufacturer  
2024-04-05: Manufacturer acknowledges receipt of security advisories  
2024-04-08: Exchange regarding security updates and disclosure timeline  
2024-05-08: Further exchange concerning security updates and disclosure  
             timeline; public release of all security advisories  
             scheduled for release of C-MOR Video Surveillance version 6  
2024-05-10: Release of C-MOR software version 5.30 with security updates  
             for some reported security issues  
2024-07-19: E-mail to manufacturer concerning release date of C-MOR  
             Video Surveillance version 6; response with planned  
             release date of 2024-08-01  
2024-07-30: E-mail from manufacturer with further information  
             concerning security fixes  
2024-07-31: Release of C-MOR software version 6.00PL1  
2024-09-04: Public release of security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for C-MOR Video Surveillance  
     https://www.c-mor.com/  
[2] SySS Security Advisory SYSS-2024-020

 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-020.txt  
[3] SySS Responsible Disclosure Policy  
     https://www.syss.de/en/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Chris Beiter, Frederik  
Beimgraben, and Matthias Deeg.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web  
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en

C-MOR Video Surveillance 5.2401 Cross Site Scripting

An issue was discovered in Veritas NetBackup before 10.0. A vulnerability in the way NetBackup validates the path to a DLL prior to loading may allow a lower level user to elevate privileges and compromise the system.

**Revision History**

*   1.0: End of September 2022 – Initial Public Release
*   1.1: March 2023 – Added Issue #3

**Summary**

Veritas has addressed vulnerabilities affecting NetBackup servers and clients.

**Issues**

**Issue #1: Arbitrary file delete**

An attacker with local access can delete arbitrary files by leveraging a path traversal in the pbx\_exchange registration code.

*   CVE ID: CVE-2022-42308
*   Severity: Critical
*   CVSS v3.1 Base Score: 9.0 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H)
*   Affected Versions: 8.2 and earlier
*   Recommended action:
    *   NetBackup Servers: upgrade to 8.2 and apply appropriate Hotfix OR upgrade to 8.3.x or later.
    *   NetBackup Clients: upgrade to 8.2 or 8.1.2 and apply appropriate Hotfix OR upgrade to 8.3.x or later.
    *   NetBackup Appliance: upgrade to 3.2 and apply appropriate Hotfix OR upgrade to 3.3.x or later.
    *   Flex Appliance: Please apply the NetBackup Hotfix corresponding to the NetBackup Container version on Flex appliances
    *   Flex Scale: Not impacted.

**Issue #2: Denial of service**

An attacker with local access can send a specially crafted packet to pbx\_exchange during registration and cause a null-pointer exception effectively crashing the pbx\_exchange process.

*   CVE ID: CVE-2022-42306
*   Severity: Medium
*   CVSS v3.1 Base Score: 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
*   Affected Versions: 8.2 and earlier
*   Recommended action:
    *   NetBackup Servers: upgrade to 8.2 and apply appropriate Hotfix OR upgrade to 8.3.x or later.
    *   NetBackup Clients: upgrade to 8.2 or 8.1.2 and apply appropriate Hotfix OR upgrade to 8.3.x or later.
    *   NetBackup Appliance: upgrade to 3.2 and apply appropriate Hotfix OR upgrade to 3.3.x or later.
    *   Flex Appliance: Please apply the NetBackup Hotfix corresponding to the NetBackup Container version on Flex appliances
    *   Flex Scale: Not impacted.

**Issue #3: Privilege Escalation**

A vulnerability in the way NetBackup validates the path to a DLL prior to loading may allow a lower level user to elevate privileges and compromise the system.

*   CVE ID: TBD
*   Severity: High
*   CVSS v3.1 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
*   Impacted Components: Primary and Media Servers and Clients
*   Affected Versions: Any prior to 10.0
*   Recommended action:
    *   NetBackup Primary & Media Servers and Clients: Upgrade to NetBackup 10.0 or later

**Notes**

This Security Advisory, VTS22-010, also addresses the issues identified in VTS22-008, which was released earlier. If you have not already applied VTS22-008, it is not necessary to apply it prior to installing this advisory. If you have already applied VTS22-008 you can safely apply VTS22-010 on top of it.

**Questions**

For questions or problems regarding this vulnerability please contact Veritas Technical Support (https://www.veritas.com/support)

**Acknowledgement**

Veritas would like to thank the following Airbus Security Team members for notifying us about issues 1 and 2:   
Mouad Abouhali, Benoît Camredon, Nicholas Devillers, Anaïs Gantet, and Jean-Romain Garnier.

Veritas would like the thank the Lockheed Martin Red Team for notifying us about Issue #3.

**Disclaimer**

THE SECURITY ADVISORY IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. VERITAS TECHNOLOGIES LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

Veritas Technologies LLC  
2625 Augustine Drive  
Santa Clara, CA 95054

CVE-2023-28759: Hotfix for Security Advisory Impacting NetBackup Clients and Servers

A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Active Directory Plugin
*   Assembla Auth Plugin
*   Benchmark Evaluator Plugin
*   Datadog Plugin
*   ElasticBox CI Plugin
*   External Monitor Job Type Plugin
*   mabl Plugin
*   MathWorks Polyspace Plugin
*   OpenShift Login Plugin
*   Oracle Cloud Infrastructure Compute Plugin
*   Orka by MacStadium Plugin
*   Pipeline restFul API Plugin
*   Rebuilder Plugin
*   SAML Single Sign On(SSO) Plugin
*   Sumologic Publisher Plugin
*   Test Results Aggregator Plugin

**Descriptions****XXE vulnerability in External Monitor Job Type Plugin**

**SECURITY-3133 / CVE-2023-37942**  
**Severity (CVSS):** High  
**Affected plugin: external-monitor-job**  
**Description:**

External Monitor Job Type Plugin 206.v9a\_94ff0b\_4a\_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

External Monitor Job Type Plugin 207.v98a\_a\_37a\_85525 disables external entity resolution for its XML parser.

**Password transmitted in plain text by Active Directory Plugin**

**SECURITY-3059 / CVE-2023-37943**  
**Severity (CVSS):** Low  
**Affected plugin: active-directory**  
**Description:**

Active Directory Plugin allows testing a new, unsaved configuration by performing a connection test (the button labeled "Test Domain").

Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted. This allows attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.

This only affects the connection test. Connections established during the login process are encrypted if the corresponding TLS option is enabled.

Active Directory Plugin 2.30.1 considers the "Require TLS" and "StartTls" options for connection tests.

**Missing permission check in Datadog Plugin allows capturing credentials**

**SECURITY-3130 / CVE-2023-37944**  
**Severity (CVSS):** Medium  
**Affected plugin: datadog**  
**Description:**

Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Datadog Plugin 5.4.2 requires Overall/Administer permission to access the affected HTTP endpoint.

**Missing permission check in SAML Single Sign On(SSO) Plugin**

**SECURITY-3164 / CVE-2023-37945**  
**Severity (CVSS):** Medium  
**Affected plugin: miniorange-saml-sp**  
**Description:**

SAML Single Sign On(SSO) Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to download a string representation of the current security realm (Java Object#toString()), which potentially includes sensitive information.

SAML Single Sign On(SSO) Plugin 2.3.1 requires Overall/Administer permission to access the affected HTTP endpoint, and only allows downloading a string representation if the current security realm is this plugin’s.

**Session fixation vulnerability in OpenShift Login Plugin**

**SECURITY-2998 / CVE-2023-37946**  
**Severity (CVSS):** High  
**Affected plugin: openshift-login**  
**Description:**

OpenShift Login Plugin 1.1.0.227.v27e08dfb\_1a\_20 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

OpenShift Login Plugin 1.1.0.230.v5d7030b\_f5432 invalidates the existing session on login.

**Open redirect vulnerability in OpenShift Login Plugin**

**SECURITY-2999 / CVE-2023-37947**  
**Severity (CVSS):** Medium  
**Affected plugin: openshift-login**  
**Description:**

OpenShift Login Plugin 1.1.0.227.v27e08dfb\_1a\_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.

OpenShift Login Plugin 1.1.0.230.v5d7030b\_f5432 only redirects to relative (Jenkins) URLs.

**Missing SSH host key validation in Oracle Cloud Infrastructure Compute Plugin**

**SECURITY-3044 / CVE-2023-37948**  
**Severity (CVSS):** Medium  
**Affected plugin: oracle-cloud-infrastructure-compute**  
**Description:**

Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not perform SSH host key validation when connecting to OCI clouds.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to OCI clouds.

Oracle Cloud Infrastructure Compute Plugin 1.0.17 provides strategies for performing host key validation for administrators to select the one that meets their security needs.

The Jenkins security team has been unable to confirm the exploitability and resolution of this vulnerability.

**Missing permission check in Orka by MacStadium Plugin allows capturing credentials**

**SECURITY-3128 / CVE-2023-37949**  
**Severity (CVSS):** Medium  
**Affected plugin: macstadium-orka**  
**Description:**

Orka by MacStadium Plugin 1.33 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Orka by MacStadium Plugin 1.34 requires Overall/Administer permission to access the affected HTTP endpoint.

**Missing permission check in mabl Plugin allows enumerating credentials IDs**

**SECURITY-3137 (1) / CVE-2023-37950**  
**Severity (CVSS):** Medium  
**Affected plugin: mabl-integration**  
**Description:**

mabl Plugin 0.0.46 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in mabl Plugin 0.0.47 requires the appropriate permissions.

**Exposure of system-scoped credentials in mabl Plugin**

**SECURITY-3137 (2) / CVE-2023-37951**  
**Severity (CVSS):** Medium  
**Affected plugin: mabl-integration**  
**Description:**

mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.

This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.

mabl Plugin 0.0.47 defines the appropriate context for credentials lookup.

**CSRF vulnerability and missing permission checks in mabl Plugin allow capturing credentials**

**SECURITY-3127 / CVE-2023-37952 (CSRF), CVE-2023-37953 (missing permission check)**  
**Severity (CVSS):** High  
**Affected plugin: mabl-integration**  
**Description:**

mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

mabl Plugin 0.0.47 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

**CSRF vulnerability in Rebuilder Plugin**

**SECURITY-3033 / CVE-2023-37954**  
**Severity (CVSS):** Medium  
**Affected plugin: rebuild**  
**Description:**

Rebuilder Plugin 320.v5a\_0933a\_e7d61 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to rebuild a previous build.

**CSRF vulnerability and missing permission check in Test Results Aggregator Plugin**

**SECURITY-3122 / CVE-2023-37955 (CSRF), CVE-2023-37956 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: test-results-aggregator**  
**Description:**

Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**CSRF vulnerability in Pipeline restFul API Plugin**

**SECURITY-3126 / CVE-2023-37957**  
**Severity (CVSS):** High  
**Affected plugin: pipeline-restful-api**  
**Description:**

Pipeline restFul API Plugin 0.11 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to have Jenkins connect to an attacker-specified URL, capturing a newly generated JCLI token that allows impersonating the victim.

**CSRF vulnerability and missing permission checks in Sumologic Publisher Plugin**

**SECURITY-3117 / CVE-2023-37958 (CSRF), CVE-2023-37959 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: sumologic-publisher**  
**Description:**

Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Arbitrary file read vulnerability in MathWorks Polyspace Plugin**

**SECURITY-3124 / CVE-2023-37960**  
**Severity (CVSS):** Medium  
**Affected plugin: mathworks-polyspace**  
**Description:**

MathWorks Polyspace Plugin 1.0.5 and earlier does not restrict the path of the attached files in Polyspace Notification post-build step.

This allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system.

**CSRF vulnerability in Assembla Auth Plugin**

**SECURITY-2988 / CVE-2023-37961**  
**Severity (CVSS):** Medium  
**Affected plugin: assembla-auth**  
**Description:**

Assembla Auth Plugin 1.14 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.

This vulnerability allows attackers to trick users into logging in to the attacker’s account.

**CSRF vulnerability and missing permission checks in Benchmark Evaluator Plugin**

**SECURITY-3119 / CVE-2023-37962 (CSRF), CVE-2023-37963 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: benchmark-evaluator**  
**Description:**

Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**CSRF vulnerability and missing permission checks in ElasticBox CI Plugin allow capturing credentials**

**SECURITY-3131 / CVE-2023-37964 (CSRF), CVE-2023-37965 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: elasticbox**  
**Description:**

ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Severity**

*   SECURITY-2988: Medium
*   SECURITY-2998: High
*   SECURITY-2999: Medium
*   SECURITY-3033: Medium
*   SECURITY-3044: Medium
*   SECURITY-3059: Low
*   SECURITY-3117: Medium
*   SECURITY-3119: Medium
*   SECURITY-3122: Medium
*   SECURITY-3124: Medium
*   SECURITY-3126: High
*   SECURITY-3127: High
*   SECURITY-3128: Medium
*   SECURITY-3130: Medium
*   SECURITY-3131: Medium
*   SECURITY-3133: High
*   SECURITY-3137 (1): Medium
*   SECURITY-3137 (2): Medium
*   SECURITY-3164: Medium

**Affected Versions**

*   **Active Directory Plugin** up to and including 2.30
*   **Assembla Auth Plugin** up to and including 1.14
*   **Benchmark Evaluator Plugin** up to and including 1.0.1
*   **Datadog Plugin** up to and including 5.4.1
*   **ElasticBox CI Plugin** up to and including 5.0.1
*   **External Monitor Job Type Plugin** up to and including 206.v9a\_94ff0b\_4a\_10
*   **mabl Plugin** up to and including 0.0.46
*   **MathWorks Polyspace Plugin** up to and including 1.0.5
*   **OpenShift Login Plugin** up to and including 1.1.0.227.v27e08dfb\_1a\_20
*   **Oracle Cloud Infrastructure Compute Plugin** up to and including 1.0.16
*   **Orka by MacStadium Plugin** up to and including 1.33
*   **Pipeline restFul API Plugin** up to and including 0.11
*   **Rebuilder Plugin** up to and including 320.v5a\_0933a\_e7d61
*   **SAML Single Sign On(SSO) Plugin** up to and including 2.3.0
*   **Sumologic Publisher Plugin** up to and including 2.2.1
*   **Test Results Aggregator Plugin** up to and including 1.2.13

**Fix**

*   **Active Directory Plugin** should be updated to version 2.30.1
*   **Datadog Plugin** should be updated to version 5.4.2
*   **External Monitor Job Type Plugin** should be updated to version 207.v98a\_a\_37a\_85525
*   **mabl Plugin** should be updated to version 0.0.47
*   **OpenShift Login Plugin** should be updated to version 1.1.0.230.v5d7030b\_f5432
*   **Oracle Cloud Infrastructure Compute Plugin** should be updated to version 1.0.17
*   **Orka by MacStadium Plugin** should be updated to version 1.34
*   **SAML Single Sign On(SSO) Plugin** should be updated to version 2.3.1

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Assembla Auth Plugin
*   Benchmark Evaluator Plugin
*   ElasticBox CI Plugin
*   MathWorks Polyspace Plugin
*   Pipeline restFul API Plugin
*   Rebuilder Plugin
*   Sumologic Publisher Plugin
*   Test Results Aggregator Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Alvaro Muñoz (@pwntester), GitHub Security Lab** for SECURITY-3117, SECURITY-3119, SECURITY-3122, SECURITY-3126, SECURITY-3127, SECURITY-3128, SECURITY-3130, SECURITY-3131
*   **Daniel Beck, CloudBees, Inc.** for SECURITY-3164
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2988, SECURITY-3033, SECURITY-3137 (1)
*   **Kevin Guerroudj, CloudBees, Inc. and Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-2998, SECURITY-2999
*   **Tony Torralba (@atorralba), GitHub Security Lab** for SECURITY-3124, SECURITY-3133
*   **Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-3044, SECURITY-3137 (2)

CVE-2023-37956: Jenkins Security Advisory 2023-07-12

Cross Site Scripting (XSS) vulnerability in the DataTables plug-in 1.9.2 for jQuery allows attackers to run arbitrary code via the sBaseName parameter to function _fnCreateCookie. NOTE: 1.9.2 is a version from 2012.

/\*\* \* @summary DataTables \* @description Paginate, search and sort HTML tables \* @version 1.9.2 \* @file jquery.dataTables.js \* @author Allan Jardine (www.sprymedia.co.uk) \* @contact www.sprymedia.co.uk/contact \* \* @copyright Copyright 2008-2012 Allan Jardine, all rights reserved. \* \* This source file is free software, under either the GPL v2 license or a \* BSD style license, available at: \* http://datatables.net/license\_gpl2 \* http://datatables.net/license\_bsd \* \* This source file is distributed in the hope that it will be useful, but \* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY \* or FITNESS FOR A PARTICULAR PURPOSE. See the license files for details. \* \* For details please refer to: http://www.datatables.net \*/ /\*jslint evil: true, undef: true, browser: true \*/ /\*globals $, jQuery,\_fnExternApiFunc,\_fnInitialise,\_fnInitComplete,\_fnLanguageCompat,\_fnAddColumn,\_fnColumnOptions,\_fnAddData,\_fnCreateTr,\_fnGatherData,\_fnBuildHead,\_fnDrawHead,\_fnDraw,\_fnReDraw,\_fnAjaxUpdate,\_fnAjaxParameters,\_fnAjaxUpdateDraw,\_fnServerParams,\_fnAddOptionsHtml,\_fnFeatureHtmlTable,\_fnScrollDraw,\_fnAdjustColumnSizing,\_fnFeatureHtmlFilter,\_fnFilterComplete,\_fnFilterCustom,\_fnFilterColumn,\_fnFilter,\_fnBuildSearchArray,\_fnBuildSearchRow,\_fnFilterCreateSearch,\_fnDataToSearch,\_fnSort,\_fnSortAttachListener,\_fnSortingClasses,\_fnFeatureHtmlPaginate,\_fnPageChange,\_fnFeatureHtmlInfo,\_fnUpdateInfo,\_fnFeatureHtmlLength,\_fnFeatureHtmlProcessing,\_fnProcessingDisplay,\_fnVisibleToColumnIndex,\_fnColumnIndexToVisible,\_fnNodeToDataIndex,\_fnVisbleColumns,\_fnCalculateEnd,\_fnConvertToWidth,\_fnCalculateColumnWidths,\_fnScrollingWidthAdjust,\_fnGetWidestNode,\_fnGetMaxLenString,\_fnStringToCss,\_fnDetectType,\_fnSettingsFromNode,\_fnGetDataMaster,\_fnGetTrNodes,\_fnGetTdNodes,\_fnEscapeRegex,\_fnDeleteIndex,\_fnReOrderIndex,\_fnColumnOrdering,\_fnLog,\_fnClearTable,\_fnSaveState,\_fnLoadState,\_fnCreateCookie,\_fnReadCookie,\_fnDetectHeader,\_fnGetUniqueThs,\_fnScrollBarWidth,\_fnApplyToChildren,\_fnMap,\_fnGetRowData,\_fnGetCellData,\_fnSetCellData,\_fnGetObjectDataFn,\_fnSetObjectDataFn,\_fnApplyColumnDefs,\_fnBindAction,\_fnCallbackReg,\_fnCallbackFire,\_fnJsonString,\_fnRender,\_fnNodeToColumnIndex,\_fnInfoMacros\*/ (/\*\* @lends \*/function($, window, document, undefined) { /\*\* \* DataTables is a plug-in for the jQuery Javascript library. It is a \* highly flexible tool, based upon the foundations of progressive \* enhancement, which will add advanced interaction controls to any \* HTML table. For a full list of features please refer to \* DataTables.net. \* \* Note that the _DataTable_ object is not a global variable but is \* aliased to _jQuery.fn.DataTable_ and _jQuery.fn.dataTable_ through which \* it may be accessed. \* \* @class \* @param {object} \[oInit={}\] Configuration object for DataTables. Options \* are defined by {@link DataTable.defaults} \* @requires jQuery 1.3+ \* \* @example \* // Basic initialisation \* $(document).ready( function { \* $('#example').dataTable(); \* } ); \* \* @example \* // Initialisation with configuration options - in this case, disable \* // pagination and sorting. \* $(document).ready( function { \* $('#example').dataTable( { \* "bPaginate": false, \* "bSort": false \* } ); \* } ); \*/ var DataTable = function( oInit ) { /\*\* \* Add a column to the list used for the table with default values \* @param {object} oSettings dataTables settings object \* @param {node} nTh The th element for this column \* @memberof DataTable#oApi \*/ function \_fnAddColumn( oSettings, nTh ) { var oDefaults = DataTable.defaults.columns; var iCol = oSettings.aoColumns.length; var oCol = $.extend( {}, DataTable.models.oColumn, oDefaults, { "sSortingClass": oSettings.oClasses.sSortable, "sSortingClassJUI": oSettings.oClasses.sSortJUI, "nTh": nTh ? nTh : document.createElement('th'), "sTitle": oDefaults.sTitle ? oDefaults.sTitle : nTh ? nTh.innerHTML : '', "aDataSort": oDefaults.aDataSort ? oDefaults.aDataSort : \[iCol\], "mDataProp": oDefaults.mDataProp ? oDefaults.oDefaults : iCol } ); oSettings.aoColumns.push( oCol ); /\* Add a column specific filter \*/ if ( oSettings.aoPreSearchCols\[ iCol \] === undefined || oSettings.aoPreSearchCols\[ iCol \] === null ) { oSettings.aoPreSearchCols\[ iCol \] = $.extend( {}, DataTable.models.oSearch ); } else { var oPre = oSettings.aoPreSearchCols\[ iCol \]; /\* Don't require that the user must specify bRegex, bSmart or bCaseInsensitive \*/ if ( oPre.bRegex === undefined ) { oPre.bRegex = true; } if ( oPre.bSmart === undefined ) { oPre.bSmart = true; } if ( oPre.bCaseInsensitive === undefined ) { oPre.bCaseInsensitive = true; } } /\* Use the column options function to initialise classes etc \*/ \_fnColumnOptions( oSettings, iCol, null ); } /\*\* \* Apply options for a column \* @param {object} oSettings dataTables settings object \* @param {int} iCol column index to consider \* @param {object} oOptions object with sType, bVisible and bSearchable \* @memberof DataTable#oApi \*/ function \_fnColumnOptions( oSettings, iCol, oOptions ) { var oCol = oSettings.aoColumns\[ iCol \]; /\* User specified column options \*/ if ( oOptions !== undefined && oOptions !== null ) { if ( oOptions.sType !== undefined ) { oCol.sType = oOptions.sType; oCol.\_bAutoType = false; } $.extend( oCol, oOptions ); \_fnMap( oCol, oOptions, "sWidth", "sWidthOrig" ); /\* iDataSort to be applied (backwards compatibility), but aDataSort will take \* priority if defined \*/ if ( oOptions.iDataSort !== undefined ) { oCol.aDataSort = \[ oOptions.iDataSort \]; } \_fnMap( oCol, oOptions, "aDataSort" ); } /\* Cache the data get and set functions for speed \*/ oCol.fnGetData = \_fnGetObjectDataFn( oCol.mDataProp ); oCol.fnSetData = \_fnSetObjectDataFn( oCol.mDataProp ); /\* Feature sorting overrides column specific when off \*/ if ( !oSettings.oFeatures.bSort ) { oCol.bSortable = false; } /\* Check that the class assignment is correct for sorting \*/ if ( !oCol.bSortable || ($.inArray('asc', oCol.asSorting) == -1 && $.inArray('desc', oCol.asSorting) == -1) ) { oCol.sSortingClass = oSettings.oClasses.sSortableNone; oCol.sSortingClassJUI = ""; } else if ( oCol.bSortable || ($.inArray('asc', oCol.asSorting) == -1 && $.inArray('desc', oCol.asSorting) == -1) ) { oCol.sSortingClass = oSettings.oClasses.sSortable; oCol.sSortingClassJUI = oSettings.oClasses.sSortJUI; } else if ( $.inArray('asc', oCol.asSorting) != -1 && $.inArray('desc', oCol.asSorting) == -1 ) { oCol.sSortingClass = oSettings.oClasses.sSortableAsc; oCol.sSortingClassJUI = oSettings.oClasses.sSortJUIAscAllowed; } else if ( $.inArray('asc', oCol.asSorting) == -1 && $.inArray('desc', oCol.asSorting) != -1 ) { oCol.sSortingClass = oSettings.oClasses.sSortableDesc; oCol.sSortingClassJUI = oSettings.oClasses.sSortJUIDescAllowed; } } /\*\* \* Adjust the table column widths for new data. Note: you would probably want to \* do a redraw after calling this function! \* @param {object} oSettings dataTables settings object \* @memberof DataTable#oApi \*/ function \_fnAdjustColumnSizing ( oSettings ) { /\* Not interested in doing column width calculation if autowidth is disabled \*/ if ( oSettings.oFeatures.bAutoWidth === false ) { return false; } \_fnCalculateColumnWidths( oSettings ); for ( var i=0 , iLen=oSettings.aoColumns.length ; i

Search

lenovo warranty check/lookup | check warranty status | lenovo support us