Security Bulletin
Summary
IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Ratpack.
Vulnerability Details
CVEID: CVE-2019-11808
DESCRIPTION: Ratpack could allow a remote attacker to obtain sensitive information, caused by the use of a weak PRNG to generate session ID in JDK's ThreadLocalRandom. By gaining a small window for the server start time and a session ID value, an attacker could exploit this vulnerability to obtain the sequence of session IDs.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/160664 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2019-17513
DESCRIPTION: Ratpack is vulnerable to HTTP header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/169577 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected Products and Versions
Affected Product(s) | Version(s) |
ICP - Discovery | 2.0.0-2.1.3 |
Remediation/Fixes
Upgrade to IBM Watson Discovery 2.1.4
https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-install
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
26 Aug 2020: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
29 August 2020
UID
ibm16323267