{ "document" : { "aggregate_severity" : { "text" : "mittel" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "Der IBM HTTP Server ist ein Webserver auf Apache Basis.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen.", "title" : "Angriff" }, { "category" : "general", "text" : "- Sonstiges", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2023-0488 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0488.json" }, { "category" : "self", "summary" : "WID-SEC-2023-0488 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0488" }, { "category" : "external", "summary" : "IBM Security Bulletin 6985851 vom 2023-04-25", "url" : "https://www.ibm.com/support/pages/node/6985851" }, { "category" : "external", "summary" : "IBM Security Bulletin 6967237 vom 2023-03-30", "url" : "https://www.ibm.com/support/pages/node/6967237" }, { "category" : "external", "summary" : "IBM Security Bulletin 6966600 vom 2023-03-28", "url" : "https://www.ibm.com/support/pages/node/6966600" }, { "category" : "external", "summary" : "IBM Security Bulletin 6963268 vom 2023-03-14", "url" : "https://www.ibm.com/support/pages/node/6963268" }, { "category" : "external", "summary" : "IBM Security Bulletin 6958697 vom 2023-02-28", "url" : "https://www.ibm.com/support/pages/node/6958697" }, { "category" : "external", "summary" : "IBM Security Advisory vom 2023-02-27", "url" : "https://www.ibm.com/support/pages/node/6958522" } ], "source_lang" : "en-US", "title" : "IBM HTTP Server: Schwachstelle ermöglicht Denial of Service", "tracking" : { "current_release_date" : "2023-04-24T22:00:00.000+00:00", "generator" : { "date" : "2024-08-15T17:44:52.947+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.3.5" } }, "id" : "WID-SEC-W-2023-0488", "initial_release_date" : "2023-02-27T23:00:00.000+00:00", "revision_history" : [ { "date" : "2023-02-27T23:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" }, { "date" : "2023-03-13T23:00:00.000+00:00", "number" : "2", "summary" : "Neue Updates von IBM aufgenommen" }, { "date" : "2023-03-27T22:00:00.000+00:00", "number" : "3", "summary" : "Neue Updates von IBM aufgenommen" }, { "date" : "2023-03-30T22:00:00.000+00:00", "number" : "4", "summary" : "Neue Updates von IBM aufgenommen" }, { "date" : "2023-04-24T22:00:00.000+00:00", "number" : "5", "summary" : "Neue Updates von IBM aufgenommen" } ], "status" : "final", "version" : "5" } }, "product_tree" : { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "IBM Business Automation Workflow", "product" : { "name" : "IBM Business Automation Workflow", "product_id" : "T019704", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:business_automation_workflow:-" } } }, { "category" : "product_name", "name" : "IBM Business Process Manager 8.6.0.0", "product" : { "name" : "IBM Business Process Manager 8.6.0.0", "product_id" : "T011152", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:business_process_manager:8.6.0.0" } } }, { "category" : "product_name", "name" : "IBM HTTP Server < 8.5.5.24", "product" : { "name" : "IBM HTTP Server < 8.5.5.24", "product_id" : "T026523", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:http_server:8.5.5.24" } } }, { "branches" : [ { "category" : "product_name", "name" : "IBM Rational ClearCase 9.0.2", "product" : { "name" : "IBM Rational ClearCase 9.0.2", "product_id" : "T021422", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:rational_clearcase:9.0.2" } } }, { "category" : "product_name", "name" : "IBM Rational ClearCase 9.1", "product" : { "name" : "IBM Rational ClearCase 9.1", "product_id" : "T021423", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:rational_clearcase:9.1" } } }, { "category" : "product_name", "name" : "IBM Rational ClearCase 10.0.0", "product" : { "name" : "IBM Rational ClearCase 10.0.0", "product_id" : "T026520", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:rational_clearcase:10.0.0" } } } ], "category" : "product_name", "name" : "Rational ClearCase" }, { "branches" : [ { "category" : "product_name", "name" : "IBM Security Access Manager for Enterprise Single Sign-On 8.2.1", "product" : { "name" : "IBM Security Access Manager for Enterprise Single Sign-On 8.2.1", "product_id" : "T005246", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:security_access_manager_for_enterprise_single_sign_on:8.2.1" } } }, { "category" : "product_name", "name" : "IBM Security Access Manager for Enterprise Single Sign-On 8.2.2", "product" : { "name" : "IBM Security Access Manager for Enterprise Single Sign-On 8.2.2", "product_id" : "T007073", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:security_access_manager_for_enterprise_single_sign_on:8.2.2" } } } ], "category" : "product_name", "name" : "Security Access Manager for Enterprise Single Sign-On" }, { "category" : "product_name", "name" : "IBM Tivoli Monitoring < 6.3.0.7 sp5", "product" : { "name" : "IBM Tivoli Monitoring < 6.3.0.7 sp5", "product_id" : "T023377", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:tivoli_monitoring:6.3.0.7_sp5" } } }, { "category" : "product_name", "name" : "IBM Tivoli Network Manager 4.2.0", "product" : { "name" : "IBM Tivoli Network Manager 4.2.0", "product_id" : "T026725", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:tivoli_network_manager:4.2.0" } } } ], "category" : "vendor", "name" : "IBM" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2023-26281", "notes" : [ { "category" : "description", "text" : "Es existiert eine Schwachstelle in IBM HTTP Server. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er eine speziell gestaltete URL verwendet, um einen Denial-of-Service-Zustand auszulösen." } ], "product_status" : { "known_affected" : [ "T021423", "T005246", "T021422", "T026725", "T019704", "T023377", "T007073", "T026520", "T011152" ] }, "release_date" : "2023-02-27T23:00:00.000+00:00", "title" : "CVE-2023-26281" } ] }