cnvd - cnvd-2025-02814

cnvd-2025-02814

Vulnerability from cnvd

Title: IBM App Connect Enterprise Certified Container拒绝服务漏洞（CNVD-2025-02814）

Description:

IBM App Connect Enterprise Certified Container是美国国际商业机器（IBM）公司的一个基于 IBM App Connect Enterprise 软件产品的映像。以可执行文件的形式提供软件包，可以在容器化环境中部署和运行。

IBM App Connect Enterprise Certified Container存在安全漏洞，该漏洞源于运行的操作数不限制写入本地文件系统，使得Pod中可用存储耗尽，从而导致该Pod重新启动。攻击者可利用该漏洞导致该Pod重新启动。

Severity: 中

Patch Name: IBM App Connect Enterprise Certified Container拒绝服务漏洞（CNVD-2025-02814）的补丁

Patch Description:

IBM App Connect Enterprise Certified Container存在安全漏洞，该漏洞源于运行的操作数不限制写入本地文件系统，使得Pod中可用存储耗尽，从而导致该Pod重新启动。攻击者可利用该漏洞导致该Pod重新启动。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7180500

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-22491

Impacted products

Name
['IBM IBM App Connect Enterprise Certified Container 7.1', 'IBM IBM App Connect Enterprise Certified Container 7.2', 'IBM IBM App Connect Enterprise Certified Container 8.0', 'IBM IBM App Connect Enterprise Certified Container 8.1', 'IBM IBM App Connect Enterprise Certified Container 8.2', 'IBM IBM App Connect Enterprise Certified Container 9.0', 'IBM IBM App Connect Enterprise Certified Container 9.1', 'IBM IBM App Connect Enterprise Certified Container 9.2', 'IBM IBM App Connect Enterprise Certified Container 10.0', 'IBM IBM App Connect Enterprise Certified Container 10.1', 'IBM IBM App Connect Enterprise Certified Container 11.0', 'IBM IBM App Connect Enterprise Certified Container 11.1', 'IBM IBM App Connect Enterprise Certified Container 11.2', 'IBM IBM App Connect Enterprise Certified Container 11.3', 'IBM IBM App Connect Enterprise Certified Container 11.4', 'IBM IBM App Connect Enterprise Certified Container 11.5', 'IBM IBM App Connect Enterprise Certified Container 11.6', 'IBM IBM App Connect Enterprise Certified Container 12.0']

Name

['IBM IBM App Connect Enterprise Certified Container 7.1', 'IBM IBM App Connect Enterprise Certified Container 7.2', 'IBM IBM App Connect Enterprise Certified Container 8.0', 'IBM IBM App Connect Enterprise Certified Container 8.1', 'IBM IBM App Connect Enterprise Certified Container 8.2', 'IBM IBM App Connect Enterprise Certified Container 9.0', 'IBM IBM App Connect Enterprise Certified Container 9.1', 'IBM IBM App Connect Enterprise Certified Container 9.2', 'IBM IBM App Connect Enterprise Certified Container 10.0', 'IBM IBM App Connect Enterprise Certified Container 10.1', 'IBM IBM App Connect Enterprise Certified Container 11.0', 'IBM IBM App Connect Enterprise Certified Container 11.1', 'IBM IBM App Connect Enterprise Certified Container 11.2', 'IBM IBM App Connect Enterprise Certified Container 11.3', 'IBM IBM App Connect Enterprise Certified Container 11.4', 'IBM IBM App Connect Enterprise Certified Container 11.5', 'IBM IBM App Connect Enterprise Certified Container 11.6', 'IBM IBM App Connect Enterprise Certified Container 12.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-22491",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-22491"
    }
  },
  "description": "IBM App Connect Enterprise Certified Container\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u57fa\u4e8e IBM App Connect Enterprise \u8f6f\u4ef6\u4ea7\u54c1\u7684\u6620\u50cf\u3002\u4ee5\u53ef\u6267\u884c\u6587\u4ef6\u7684\u5f62\u5f0f\u63d0\u4f9b\u8f6f\u4ef6\u5305\uff0c\u53ef\u4ee5\u5728\u5bb9\u5668\u5316\u73af\u5883\u4e2d\u90e8\u7f72\u548c\u8fd0\u884c\u3002\n\nIBM App Connect Enterprise Certified Container\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fd0\u884c\u7684\u64cd\u4f5c\u6570\u4e0d\u9650\u5236\u5199\u5165\u672c\u5730\u6587\u4ef6\u7cfb\u7edf\uff0c\u4f7f\u5f97Pod\u4e2d\u53ef\u7528\u5b58\u50a8\u8017\u5c3d\uff0c\u4ece\u800c\u5bfc\u81f4\u8be5Pod\u91cd\u65b0\u542f\u52a8\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8be5Pod\u91cd\u65b0\u542f\u52a8\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7180500",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-02814",
  "openTime": "2025-02-11",
  "patchDescription": "IBM App Connect Enterprise Certified Container\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u57fa\u4e8e IBM App Connect Enterprise \u8f6f\u4ef6\u4ea7\u54c1\u7684\u6620\u50cf\u3002\u4ee5\u53ef\u6267\u884c\u6587\u4ef6\u7684\u5f62\u5f0f\u63d0\u4f9b\u8f6f\u4ef6\u5305\uff0c\u53ef\u4ee5\u5728\u5bb9\u5668\u5316\u73af\u5883\u4e2d\u90e8\u7f72\u548c\u8fd0\u884c\u3002\r\n\r\nIBM App Connect Enterprise Certified Container\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fd0\u884c\u7684\u64cd\u4f5c\u6570\u4e0d\u9650\u5236\u5199\u5165\u672c\u5730\u6587\u4ef6\u7cfb\u7edf\uff0c\u4f7f\u5f97Pod\u4e2d\u53ef\u7528\u5b58\u50a8\u8017\u5c3d\uff0c\u4ece\u800c\u5bfc\u81f4\u8be5Pod\u91cd\u65b0\u542f\u52a8\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8be5Pod\u91cd\u65b0\u542f\u52a8\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM App Connect Enterprise Certified Container\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2025-02814\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM IBM App Connect Enterprise Certified Container  7.1",
      "IBM IBM App Connect Enterprise Certified Container  7.2",
      "IBM IBM App Connect Enterprise Certified Container  8.0",
      "IBM IBM App Connect Enterprise Certified Container  8.1",
      "IBM IBM App Connect Enterprise Certified Container  8.2",
      "IBM IBM App Connect Enterprise Certified Container  9.0",
      "IBM IBM App Connect Enterprise Certified Container  9.1",
      "IBM IBM App Connect Enterprise Certified Container  9.2",
      "IBM IBM App Connect Enterprise Certified Container  10.0",
      "IBM IBM App Connect Enterprise Certified Container  10.1",
      "IBM IBM App Connect Enterprise Certified Container  11.0",
      "IBM IBM App Connect Enterprise Certified Container  11.1",
      "IBM IBM App Connect Enterprise Certified Container  11.2",
      "IBM IBM App Connect Enterprise Certified Container  11.3",
      "IBM IBM App Connect Enterprise Certified Container  11.4",
      "IBM IBM App Connect Enterprise Certified Container  11.5",
      "IBM IBM App Connect Enterprise Certified Container  11.6",
      "IBM IBM App Connect Enterprise Certified Container  12.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-22491",
  "serverity": "\u4e2d",
  "submitTime": "2025-02-08",
  "title": "IBM App Connect Enterprise Certified Container\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2025-02814\uff09"
}

CVE-2022-22491 (GCVE-0-2022-22491)

Vulnerability from cvelistv5

Published

2025-01-09 14:11

Modified

2025-01-09 14:22

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

IBM App Connect Enterprise Certified Container 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, and 12.4 operands running in Red Hat OpenShift do not restrict writing to the local filesystem, which may result in exhausting the available storage in a Pod, resulting in that Pod being restarted.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/7180500

Impacted products

	Vendor	Product	Version
	IBM	App Connect Enterprise Certified Container	Version: 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4 cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.3:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.4:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.5:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.6:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.3:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.4:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-22491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T14:21:17.281118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T14:22:35.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "App Connect Enterprise Certified Container",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM App Connect Enterprise Certified Container\u0026nbsp;7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, and 12.4 operands running in Red Hat OpenShift do not restrict writing to the local filesystem, which may result in exhausting the available storage in a Pod, resulting in that Pod being restarted."
            }
          ],
          "value": "IBM App Connect Enterprise Certified Container\u00a07.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, and 12.4 operands running in Red Hat OpenShift do not restrict writing to the local filesystem, which may result in exhausting the available storage in a Pod, resulting in that Pod being restarted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-09T14:11:28.233Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "url": "https://www.ibm.com/support/pages/node/7180500"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM App Connect Enterprise Certified Container denial of service",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2022-22491",
    "datePublished": "2025-01-09T14:11:28.233Z",
    "dateReserved": "2022-01-03T22:29:21.009Z",
    "dateUpdated": "2025-01-09T14:22:35.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted