IBM Support

IT48012: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2024-9880

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • CVEs: (details as of the time of ADV creation)
CVEID: CVE-2024-9880
Description: A command injection vulnerability exists in the
`pandas.DataFrame.query` function of pandas-dev/pandas
versions up to and including v2.2.2. This vulnerability allows
an attacker to execute arbitrary commands on the server by
crafting a malicious query. The issue arises from the improper
validation of user-supplied input in the `query`
function when using the 'python' engine, leading to
potential remote command execution.
CWE: CWE-94: Improper Control of Generation of Code ('Code
Injection')
CVSS Source: security@huntr.dev
CVSS Base Score: 8.4
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Local fix

  • 



Problem summary


    

  • ****************************************************************
* USERS AFFECTED:                                              *
* IBM Storage Insights users                                   *
*                                                              *
****************************************************************
* PROBLEM DESCRIPTION:                                         *
* SECURITY APAR FOR:                                           *
* CVE-2024-9880                                                *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************

    



Problem conclusion


    

  • The fix for this APAR is contained in the following release:

IBM Storage Insights 2Q25   [ 54X-IBM-SI ]
( release target 2Q 2025 / May )

To protect IBM Storage Insights against emerging
security vulnerabilities, the service was updated to
protected against vulnerabilities.

No action is required, there is nothing that you need
to do following the IBM Storage Insights upgrade.

    



Temporary fix


    

  • 



Comments


    

  • 



APAR Information




    

  • APAR number
    IT48012
    • 

  • Reported component name
    STORAGE INSIGHT
    • 

  • Reported component ID
    5608TPCSI
    • 

  • Reported release
    54X
    • 

  • Status
    CLOSED  PER
    • 

  • PE
    NoPE
    • 

  • HIPER
    NoHIPER
    • 

  • Special Attention
    NoSpecatt / Xsystem
    • 

  • Submitted date
    2025-05-02
    • 

  • Closed date
    2025-05-23
    • 

  • Last modified date
    2025-05-23
    • 





    

  • APAR is sysrouted FROM one or more of the following:
    

    • 

  • APAR is sysrouted TO one or more of the following:
    

    • 



Fix information


    

  • Fixed component name
    STORAGE INSIGHT
    • 

  • Fixed component ID
    5608TPCSI
    • 



Applicable component levels


    








      
              
                            

              

              [{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSQRB8","label":"IBM Storage Insights"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"54X","Line of Business":{"code":"LOB69","label":"Storage TPS"}}]
              

                                                                    

          
 
        

      

    

      

        

          

            
Document Information


            

            


                        

            Modified date:
            

            13 January 2026
            

            
                      

        


        

        


      

    

  



    

  

  
    
            

          
Page Feedback