Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2020.1281 Security Bulletin: Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7 9 April 2020 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: IBM Resilient Publisher: IBM Operating System: Red Hat Impact/Access: Cross-site Scripting -- Remote with User Interaction Provide Misleading Information -- Remote with User Interaction Access Confidential Data -- Remote/Unauthenticated Unauthorised Access -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2019-10160 CVE-2019-9948 CVE-2019-9947 Reference: ESB-2020.1243 ESB-2020.1174 ESB-2020.0397 ESB-2020.0296 Original Bulletin: https://www.ibm.com/support/pages/node/6173469 https://www.ibm.com/support/pages/node/6173463 https://www.ibm.com/support/pages/node/6173445 Comment: This bulletin contains three (3) IBM security advisories. - --------------------------BEGIN INCLUDED TEXT-------------------- Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7 Security Bulletin Summary Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7. CVE-2019-9948 and CVE-2019-9947 are fixed in RHEL7 as part of Errata RHSA-2019:2030 (https://access.redhat.com/errata/RHSA-2019:2030). This update is included in Resilient 34.1.53, released on September 17, 2019, and subsequent versions. Vulnerability Details CVEID: CVE-2019-9948 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by improper input validation by the urllib. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass the blacklist file: URIs protection mechanisms. CVSS Base score: 5.3 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/ 158831 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) CVEID: CVE-2019-9947 DESCRIPTION: Python is vulnerable to HTTP header injection, caused by improper validation of input in urllib and urllib2. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. CVSS Base score: 6.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/ 158830 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Affected Products and Versions +--------------------+----------+ |Affected Product(s) |Version(s)| +--------------------+----------+ |IBM Resilient |v33.x | +--------------------+----------+ |IBM Resilient |v34.0 | +--------------------+----------+ Remediation/Fixes CVE-2019-9948 and CVE-2019-9947 are fixed in RHEL7 as part of Errata RHSA-2019:2030 ( https://access.redhat.com/errata/RHSA-2019 :2030). This update is included in Resilient 34.1.53, released on September 17, 2019, and subsequent versions. It can be installed by following the instructions in https://www.ibm.com/ support/knowledgecenter/SSBRUQ_34.0.0/com.ibm.resilient.doc/install/ resilient_install_updates_sw.htm. The relevant package is python-2.7.5-86.el7.x86_64.rpm Workarounds and Mitigations None - -------------------------------------------------------------------------------- Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7 Security Bulletin Summary Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7. CVE-2019-9948 and CVE-2019-9947 are fixed in RHEL7 as part of Errata RHSA-2019:2030 (https://access.redhat.com/errata/RHSA-2019:2030). This update is included in Resilient 34.1.53, released on September 17, 2019, and subsequent versions. Vulnerability Details CVEID: CVE-2019-9948 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by improper input validation by the urllib. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass the blacklist file: URIs protection mechanisms. CVSS Base score: 5.3 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/ 158831 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) CVEID: CVE-2019-9947 DESCRIPTION: Python is vulnerable to HTTP header injection, caused by improper validation of input in urllib and urllib2. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. CVSS Base score: 6.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/ 158830 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Affected Products and Versions +--------------------+----------+ |Affected Product(s) |Version(s)| +--------------------+----------+ |IBM Resilient |v33.x | +--------------------+----------+ |IBM Resilient |V34.0 | +--------------------+----------+ |IBM Resilient |v34.x | +--------------------+----------+ Remediation/Fixes CVE-2019-9948 and CVE-2019-9947 are fixed in RHEL7 as part of Errata RHSA-2019:2030 ( https://access.redhat.com/errata/RHSA-2019 :2030). This update is included in Resilient 34.1.53, released on September 17, 2019, and subsequent versions. It can be installed by following the instructions in https://www.ibm.com/ support/knowledgecenter/SSBRUQ_34.0.0/com.ibm.resilient.doc/install/ resilient_install_updates_sw.htm. The relevant package is python-2.7.5-86.el7.x86_64.rpm Workarounds and Mitigations None - -------------------------------------------------------------------------------- Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7 Security Bulletin Summary Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7. CVE-2019-10160 is fixed in RHEL7 as part of Errata RHSA-2019:1587 (https://access.redhat.com/errata/RHSA-2019:1587). This update is included in Resilient 33.0.5087 released on June28, 2019, and subsequent versions. Vulnerability Details CVEID: CVE-2019-10160 DESCRIPTION: Python urllib.parse.urlsplit and urllib.parse.urlparse components could allow a remote attacker to obtain sensitive information, caused by improper unicode encoding handling. By using a specially-crafted URL, an attacker could exploit this vulnerability to obtain sensitive information. CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/ 162358 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Affected Products and Versions +--------------------+----------+ |Affected Product(s) |Version(s)| +--------------------+----------+ |IBM Resilient |v33.x | +--------------------+----------+ |IBM Resilient |v34.0 | +--------------------+----------+ Remediation/Fixes CVE-2019-10160 is fixed in RHEL7 as part of Errata RHSA-2019:1587 ( https:// access.redhat.com/errata/RHSA-2019 :1587). This update is included in Resilient 33.0.5087 released on June28, 2019, and subsequent versions. It can be installed by following the instructions in https://www.ibm.com/support/ knowledgecenter/SSBRUQ_33.0.0/com.ibm.resilient.doc/install/ resilient_install_updates_sw.htm. The relevant package is python-2.7.5-80.el7_6.x86_64.rpm Workarounds and Mitigations None - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXo65+GaOgq3Tt24GAQgMLQ//SFQaMAilKYqFNEW07aNfdV1SHNmKuiPY KShOEVoSadFmjzB1jkJixfKNia5XNEK7KImDei8L5XgrRqck2OQjR8EnRPX20tiZ CcikC2VK7WFVSOhX7UkcKV/Q1DrVmvThVfd5yFdiE8sZdkV/9nJ6iHLU/49TqG7s 9DoEoj9cxS0IjqfEtRgbP7RHvW3Ft09u2idXunmvFHsrjsc00T7iDR2FFey75Xvv NTRX2VLnA9nMbthbbxP1kHNotNY+/iwgaBAEsKtmttRmYYTmz979U6pVDp6kDZmH +tTRPu6jiLlel3EOUUv0eOEdM6Vuc2VcylMl+ztg9RcM48KB8/MTc6xWX+XLAgtS S9fEkrBUSCAVttunBjbBeYdcsIiXQHH0bpWvzWrCPikC9r38Has3JUlAneoiAqJ6 aog0mnyOXgTSIa0VWQkKDYRlTZmhcByQLToIKWVdlPuaS729NCPHUiw5Ilwcynlq E+OnsivT8HmjHg/82SvERo4ZLgrUU6jjHsHBzk0ryNgNGw+h6sHW2WVPnK6nlrGg Mht7K7ADY0g251QsU73gHT2S6xQ8MfSP42B+gVgePXXYYlRYRrzz9FzT0U0HG5Kx fU5JzIUCmdJOq3QSRG8BKMucYyzk4jmV09PuyoG9VdyYKUNZCnSYGSE7kuOK7C6X QpJxz4TSu1k= =jBrn -----END PGP SIGNATURE-----