PT-2023-7210 · Ibm · Ibm Aix

Published 2023-11-07 · Updated 2024-09-03 · CVE-2023-45167

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM AIX version 7.3

Description The issue is related to the Python implementation in IBM AIX, which could allow a non-privileged local user to cause a denial of service due to insufficient input validation. A race condition in the SSLSocket module may also allow a remote attacker to bypass security restrictions by injecting a malicious client certificate into the connection, potentially gaining access to the server's resources without authentication.

Recommendations For IBM AIX version 7.3, consider disabling the vulnerable Python implementation until a patch is available. As a temporary workaround, restrict access to the SSLSocket module to minimize the risk of exploitation. Avoid using the affected Python implementation for remote connections until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2023-08238

CVE-2023-45167

Affected Products

Ibm Aix

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-45167 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45167 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08238 · Security Note
• https://ibm.com/support/pages/node/7068084 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/267965 · Vendor Advisory
• https://aix.software.ibm.com/aix/efixes/security/python_advisory6.asc · Vendor Advisory
• https://twitter.com/CVEnew/status/1722830867863838815 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023111404 · Note
• https://twitter.com/VulmonFeeds/status/1722871122310389989 · Twitter Post