IT46148: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2024-25180

APAR status

• Closed as program error.

Error description

• CVEID: CVE-2024-25180
  Description: pdfmake could allow a remote attacker to execute
  arbitrary code on the system, caused by improper neutralization
  of user supplied-input. By sending a specially crafted request,
  an attacker could exploit this vulnerability to execute
  arbitrary code on the system.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR: CVE-2024-25180                            *
  *                                                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is targeted for the following release:
  
  IBM Storage Insights 2Q24   [ 54X-IBM-SI ]
  ( release target 2Q 2024 / May )
  
  The target dates for future releases do not represent a formal
  commitment by IBM. The dates are subject to change without
  notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels