Security Bulletin
Summary
IBM Cloud Private for Data is affected by multiple vulnerabilities in Open Source Go Language which could allow a remote attacker to traverse directories on the system, to execute arbitrary code on the system, or mount a denial of service attack.
Vulnerability Details
CVEID: CVE-2018-16874
DESCRIPTION: Go Programming Language could allow a remote attacker to traverse directories on the system, caused by improper input validation by the go get command. An attacker could send a specially-crafted Go package containing "dot dot" sequences (/../) to write arbitrary files on the system.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/154317 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
CVEID: CVE-2018-16873
DESCRIPTION: Go Programming Language could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation by the go get command. By sending a specially-crafted argument, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/154316 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2018-16875
DESCRIPTION: Go Programming Language is vulnerable to a denial of service, caused by the failure to limit the amount of work performed for each chain verification. By sending specially-crafted pathological inputs, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/154318 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products and Versions
Remediation/Fixes
- Users of IBM Cloud Private for Data V1.1.0 and V1.1.0.1 are advised to contact IBM Support for instructions on obtaining the fix patch and upgrading to V1.2.1.1.
- Uses of IBM Cloud Private for Data V1.2.0 or later are advised to contact IBM Support for instructions on obtaining the fix patch for V1.2.1.1 and upgrading to V1.2.1.1.
Workarounds and Mitigations
Get Notified about Future Security Bulletins
References
Change History
17 May 2019: Original Version Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
03 October 2019
UID
ibm10884752