IBM SDK Vulnerable to Denial of Service Attack
CVE-2023-38264

7.5HIGH

Key Information:

Vendor

IBM
Status
Sdk, Java Technology Edition
Vendor
CVE Published:
14 May 2024

What is CVE-2023-38264?

The IBM SDK, Java Technology Edition, specifically in its Object Request Broker (ORB) components across various versions, is susceptible to denial of service attacks under certain conditions. This vulnerability arises from improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters, potentially allowing attackers to exploit this flaw and disrupt service availability. Immediate attention and remediation are recommended to mitigate risks associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SDK, Java Technology Edition 7.1.0.0 <= 7.1.5.21

SDK, Java Technology Edition 8.0.0.0 <= 8.0.8.21

References

https://www.ibm.com/support/pages/node/7150727
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/260578
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.