IBM Cloud Pak for Business Automation Security Bulletin: Multiple CVEs including Container Escape and RCE

### Critical Vulnerability Information #### Vulnerability Overview - **Announcement**: This security announcement addresses multiple security vulnerabilities in IBM Cloud Pak for Business Automation versions 24.0.0-PF005 and 24.0.1-PF002. - **CVE IDs**: CVE-2024-4332, CVE-2024-9342, CVE-2023-5470, CVE-2024-5561, CVE-2023-5778, CVE-2023-5838, CVE-2022-4218, CVE-2023-5715, CVE-2024-5114, CVE-2024-5044, CVE-2024-5233, CVE-2024-5227, CVE-2024-5002, CVE-2024-5120, CVE-2024-5057. #### Vulnerability Details - **CVE-2024-4332**: - **Description**: In runc, an attacker can exploit a container escape vulnerability by creating hard links or symbolic links to files in any directory between two containers via shared volumes, potentially leading to container escape. - **CVSS Score**: Base score of 3.6, vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). - **CVE-2024-9342**: - **Description**: In Eclipse IDE, certain functions do not check for NULL return values or memory allocation failures, leading to null pointer dereference crashes. - **CVSS Score**: Base score of 4.5, vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). - **CVE-2023-5470**: - **Description**: In OpenJDK, a buffer overflow vulnerability exists when input format strings and parameters exceed buffer size. - **CVSS Score**: Base score of 7.8, vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/M:H). - **CVE-2024-5561**: - **Description**: In Apache Kafka, versions prior to 7.0.5 are vulnerable to a regular expression denial-of-service (DoS) attack. Attackers can consume CPU resources by sending large, complex regular expressions. - **CVSS Score**: Base score of 4.3, vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). - **CVE-2023-5778**: - **Description**: The Babel compiler generates incorrect output when processing certain JavaScript code, potentially allowing authorized users to bypass server-side security checks. - **CVSS Score**: Base score of 6.5, vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). - **CVE-2023-5838**: - **Description**: IBM Business Automation Workflow allows authorized users to bypass server-side security checks, leading to service disruption. - **CVSS Score**: Base score of 6.5, vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). - **CVE-2022-4218**: - **Description**: Eclipse IDE allows a local authenticated attacker to access sensitive information such as passwords and credentials. - **CVSS Score**: Base score of 5.5, vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). - **CVE-2023-5715**: - **Description**: Apache Kafka client uses hostname trust for browsers and node.js, potentially leading to cross-site request forgery (CSRF) attacks. - **CVSS Score**: Base score of 6.0, vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). - **CVE-2024-5114**: - **Description**: Files or directories accessible to external entities may allow attackers to configure applications for custom behavior, including ConfProvider plugins to manipulate these configurations. - **CVSS Score**: Base score of 9.0, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:H/I:H/A:H). - **CVE-2024-5044**: - **Description**: A deserialization vulnerability in Java SE components may lead to remote code execution (RCE) attacks. - **CVSS Score**: Base score of 4.8, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:L/I:L/A:N). - **CVE-2024-5233**: - **Description**: A deserialization vulnerability in Java SE components may lead to remote code execution (RCE) attacks. - **CVSS Score**: Base score of 3.7, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:N/I:L/A:N). - **CVE-2024-5227**: - **Description**: A deserialization vulnerability in Java SE components may lead to remote code execution (RCE) attacks. - **CVSS Score**: Base score of 3.7, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:N/I:L/A:N). - **CVE-2024-5002**: - **Description**: A deserialization vulnerability in Java SE components may lead to remote code execution (RCE) attacks. - **CVSS Score**: Base score of 5.3, vector: (CVSS:3.1/AV:N/PR:N/UI:R/S:U/C:N/I:L/A:N). #### Affected Products and Versions - **Affected Product**: IBM Cloud Pak for Business Automation - **Affected Versions**: V24.0.1 - V24.0.1-PF001, V24.0.0 - V24.0.0-PF005, and earlier unsupported versions #### Remediation - **Patch**: Apply security updates to version V24.0.1-PF002 or V24.0.0-PF006.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Cloud Pak for Business Automation Security Bulletin: Multiple CVEs including Container Escape and RCE