PT-2022-10791 · Ibm · Ibm Datapower Gateway

Published 2022-05-17 · Updated 2022-07-12 · CVE-2021-38872

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.4 IBM DataPower Gateway versions 10.0.2.0 IBM DataPower Gateway versions 10.0.3.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.17

Description The issue allows a remote user to cause a denial of service by consuming resources with multiple requests.

Recommendations For IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.4, update to a version that is not affected by this issue. For IBM DataPower Gateway versions 10.0.2.0, update to a version that is not affected by this issue. For IBM DataPower Gateway versions 10.0.3.0, update to a version that is not affected by this issue. For IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.17, update to a version that is not affected by this issue. As a temporary workaround, consider restricting the number of requests from a single remote user to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-38872

Affected Products

Ibm Datapower Gateway

References · 6

• https://osv.dev/vulnerability/CVE-2021-38872 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/208348 · Vendor Advisory
• https://ibm.com/support/pages/node/6586704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38872 · Security Note
• https://t.me/cibsecurity/42833 · Telegram Post
• https://t.me/cvenotify/30329 · Telegram Post