## Summary
In addition to many updates of operating system level packages, the following security vulnerability is addressed with IBM Cloud Pak for Business Automation 21.0.3-IF020 and 22.0.2-IF004.
## Vulnerability Details
** CVEID: **[CVE-2023-24998]()
** DESCRIPTION: **Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By sending a specially-crafted request with series of uploads, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/247895]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
** CVEID: **[CVE-2023-20861]()
** DESCRIPTION: **VMware Tanzu Spring Framework is vulnerable to a denial of service. By sending a specially crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/250701]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
** CVEID: **[CVE-2023-25690]()
** DESCRIPTION: **Apache HTTP Server is vulnerable to HTTP request splitting attacks, caused by an error when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch. A remote attacker could exploit this vulnerability to bypass access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning.
CVSS Base score: 6.1
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/249287]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
** CVEID: **[CVE-2023-0482]()
** DESCRIPTION: **RESTEasy could allow a local authenticated attacker to gain elevated privileges on the system, caused by the creation of insecure temp files in the File.createTempFile() used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base score: 5.3
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/246304]() for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
** CVEID: **[CVE-2023-25194]()
** DESCRIPTION: **Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization when configuring the connector via the Kafka Connect REST API. By sending specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service on the system.
CVSS Base score: 8.8
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/246698]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
## Affected Products and Versions
**Affected Product(s)**| **Version(s)**| **Status**
—|—|—
IBM Cloud Pak for Business Automation| V22.0.2 – V22.0.2-IF003| affected
IBM Cloud Pak for Business Automation| V21.0.3 – V21.0.3-IF019| affected
IBM Cloud Pak for Business Automation| V22.0.1 – V22.0.1-IF006 and later fixes
V21.0.2 – V21.0.2-IF012 and later fixes
V21.0.1 – V21.0.1-IF007 and later fixes
V20.0.1 – V20.0.3 and later fixes
V19.0.1 – V19.0.3 and later fixes
V18.0.0 – V18.0.2 and later fixes| affected
## Remediation/Fixes
Any open source library may be included in one or more sub-components of IBM Cloud Pak for Business Automation. Open source updates are not always synchronized across all components. The CVE in this bulletin are specifically addressed by
CVE ID| Addressed in component
—|—
CVE-2023-0482| Operational Decision Management
CVE-2023-20861| Business Automation Workflow
CVE-2023-24998| Automation Decision Services, Business Automation Studio, Business Automation Workflow, Workflow Process Service
CVE-2023-25194| Automation Decision Services
CVE-2023-25690| Automation Decision Services
Affected Product(s)| Version(s)| Remediation / Fix
—|—|—
IBM Cloud Pak for Business Automation| V22.0.2 – V22.0.2-IF002| Apply security fix [22.0.2-IF004]( “22.0.2-IF004” )
IBM Cloud Pak for Business Automation| V21.0.3 – V21.0.3-IF019| Apply security fix [21.0.3-IF020]( “21.0.3-IF020” ) or upgrade to [22.0.2-IF004]( “22.0.2-IF004” )
IBM Cloud Pak for Business Automation| V21.0.1 – V21.0.1-IF008
V20.0.1 – V20.0.3
V19.0.1 – V19.0.3
V18.0.0 – V18.0.2| Upgrade to [21.0.3-IF020]( “21.0.3-IF020” ) or [22.0.2-IF004]( “22.0.2-IF004” )
## Workarounds and Mitigations
None