IT49003: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2024-45296

APAR status

• Closed as program error.

Error description

• CVEID: CVE-2024-45296
  Description: pillarjs Path-to-RegExp is vulnerable to a denial
  of service, caused by a regular expression denial of service
  (ReDoS) flaw. By sending a specially crafted regex request, a
  remote attacker could exploit this vulnerability to cause a
  denial of service condition.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR CVE-2024-45296                             *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is targeted for the following release:
  
  IBM Storage Insights 1Q26   [ 54X-IBM-SI ]
  ( release target 1Q 2026 / January )
  
  The target dates for future releases do not represent a formal
  commitment by IBM. The dates are subject to change without
  notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels