QID 379592

QID 379592: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty Denial of Service (DoS) Vulnerability (7145942)

There is a vulnerability in the jose4j library used by IBM WebSphere Application Server traditional and used by the IBM WebSphere Application Server Liberty.
jose4j is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted p2c value, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Affected Versions:
BM WebSphere Application Server Liberty v21.0.0.3 - v24.0.0.3
IBM WebSphere Application Server v9.0
IBM WebSphere Application Server v8.5

QID Detection Logic:(Authenticated)
It reads the fix xml file and WebSphereApplicationServer.properties to detect the vulnerable version. and it also checks for fixpack version.

Successful exploit by a remote attacker could exploit this vulnerability to cause a denial of service condition.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

For more information kindly refer 7145942

Vendor References

7145942 - www.ibm.com/support/pages/node/7145942

CVEs related to QID 379592

CVE-2023-51775 |

Software Advisories

Advisory ID	Software	Component	Link
v			www.ibm.com/support/pages/node/7145942

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].