cnvd - cnvd-2025-02814

CNVD-2025-02814

Vulnerability from cnvd - Published: 2025-02-11

Title

IBM App Connect Enterprise Certified Container拒绝服务漏洞（CNVD-2025-02814）

Description

IBM App Connect Enterprise Certified Container是美国国际商业机器（IBM）公司的一个基于 IBM App Connect Enterprise 软件产品的映像。以可执行文件的形式提供软件包，可以在容器化环境中部署和运行。 IBM App Connect Enterprise Certified Container存在安全漏洞，该漏洞源于运行的操作数不限制写入本地文件系统，使得Pod中可用存储耗尽，从而导致该Pod重新启动。攻击者可利用该漏洞导致该Pod重新启动。

Severity

中

Patch Name

IBM App Connect Enterprise Certified Container拒绝服务漏洞（CNVD-2025-02814）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7180500

Reference

https://nvd.nist.gov/vuln/detail/CVE-2022-22491

Impacted products

Name
['IBM IBM App Connect Enterprise Certified Container 7.1', 'IBM IBM App Connect Enterprise Certified Container 7.2', 'IBM IBM App Connect Enterprise Certified Container 8.0', 'IBM IBM App Connect Enterprise Certified Container 8.1', 'IBM IBM App Connect Enterprise Certified Container 8.2', 'IBM IBM App Connect Enterprise Certified Container 9.0', 'IBM IBM App Connect Enterprise Certified Container 9.1', 'IBM IBM App Connect Enterprise Certified Container 9.2', 'IBM IBM App Connect Enterprise Certified Container 10.0', 'IBM IBM App Connect Enterprise Certified Container 10.1', 'IBM IBM App Connect Enterprise Certified Container 11.0', 'IBM IBM App Connect Enterprise Certified Container 11.1', 'IBM IBM App Connect Enterprise Certified Container 11.2', 'IBM IBM App Connect Enterprise Certified Container 11.3', 'IBM IBM App Connect Enterprise Certified Container 11.4', 'IBM IBM App Connect Enterprise Certified Container 11.5', 'IBM IBM App Connect Enterprise Certified Container 11.6', 'IBM IBM App Connect Enterprise Certified Container 12.0']

Name

['IBM IBM App Connect Enterprise Certified Container 7.1', 'IBM IBM App Connect Enterprise Certified Container 7.2', 'IBM IBM App Connect Enterprise Certified Container 8.0', 'IBM IBM App Connect Enterprise Certified Container 8.1', 'IBM IBM App Connect Enterprise Certified Container 8.2', 'IBM IBM App Connect Enterprise Certified Container 9.0', 'IBM IBM App Connect Enterprise Certified Container 9.1', 'IBM IBM App Connect Enterprise Certified Container 9.2', 'IBM IBM App Connect Enterprise Certified Container 10.0', 'IBM IBM App Connect Enterprise Certified Container 10.1', 'IBM IBM App Connect Enterprise Certified Container 11.0', 'IBM IBM App Connect Enterprise Certified Container 11.1', 'IBM IBM App Connect Enterprise Certified Container 11.2', 'IBM IBM App Connect Enterprise Certified Container 11.3', 'IBM IBM App Connect Enterprise Certified Container 11.4', 'IBM IBM App Connect Enterprise Certified Container 11.5', 'IBM IBM App Connect Enterprise Certified Container 11.6', 'IBM IBM App Connect Enterprise Certified Container 12.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-22491",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-22491"
    }
  },
  "description": "IBM App Connect Enterprise Certified Container\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u57fa\u4e8e IBM App Connect Enterprise \u8f6f\u4ef6\u4ea7\u54c1\u7684\u6620\u50cf\u3002\u4ee5\u53ef\u6267\u884c\u6587\u4ef6\u7684\u5f62\u5f0f\u63d0\u4f9b\u8f6f\u4ef6\u5305\uff0c\u53ef\u4ee5\u5728\u5bb9\u5668\u5316\u73af\u5883\u4e2d\u90e8\u7f72\u548c\u8fd0\u884c\u3002\n\nIBM App Connect Enterprise Certified Container\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fd0\u884c\u7684\u64cd\u4f5c\u6570\u4e0d\u9650\u5236\u5199\u5165\u672c\u5730\u6587\u4ef6\u7cfb\u7edf\uff0c\u4f7f\u5f97Pod\u4e2d\u53ef\u7528\u5b58\u50a8\u8017\u5c3d\uff0c\u4ece\u800c\u5bfc\u81f4\u8be5Pod\u91cd\u65b0\u542f\u52a8\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8be5Pod\u91cd\u65b0\u542f\u52a8\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7180500",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-02814",
  "openTime": "2025-02-11",
  "patchDescription": "IBM App Connect Enterprise Certified Container\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u57fa\u4e8e IBM App Connect Enterprise \u8f6f\u4ef6\u4ea7\u54c1\u7684\u6620\u50cf\u3002\u4ee5\u53ef\u6267\u884c\u6587\u4ef6\u7684\u5f62\u5f0f\u63d0\u4f9b\u8f6f\u4ef6\u5305\uff0c\u53ef\u4ee5\u5728\u5bb9\u5668\u5316\u73af\u5883\u4e2d\u90e8\u7f72\u548c\u8fd0\u884c\u3002\r\n\r\nIBM App Connect Enterprise Certified Container\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fd0\u884c\u7684\u64cd\u4f5c\u6570\u4e0d\u9650\u5236\u5199\u5165\u672c\u5730\u6587\u4ef6\u7cfb\u7edf\uff0c\u4f7f\u5f97Pod\u4e2d\u53ef\u7528\u5b58\u50a8\u8017\u5c3d\uff0c\u4ece\u800c\u5bfc\u81f4\u8be5Pod\u91cd\u65b0\u542f\u52a8\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8be5Pod\u91cd\u65b0\u542f\u52a8\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM App Connect Enterprise Certified Container\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2025-02814\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM IBM App Connect Enterprise Certified Container  7.1",
      "IBM IBM App Connect Enterprise Certified Container  7.2",
      "IBM IBM App Connect Enterprise Certified Container  8.0",
      "IBM IBM App Connect Enterprise Certified Container  8.1",
      "IBM IBM App Connect Enterprise Certified Container  8.2",
      "IBM IBM App Connect Enterprise Certified Container  9.0",
      "IBM IBM App Connect Enterprise Certified Container  9.1",
      "IBM IBM App Connect Enterprise Certified Container  9.2",
      "IBM IBM App Connect Enterprise Certified Container  10.0",
      "IBM IBM App Connect Enterprise Certified Container  10.1",
      "IBM IBM App Connect Enterprise Certified Container  11.0",
      "IBM IBM App Connect Enterprise Certified Container  11.1",
      "IBM IBM App Connect Enterprise Certified Container  11.2",
      "IBM IBM App Connect Enterprise Certified Container  11.3",
      "IBM IBM App Connect Enterprise Certified Container  11.4",
      "IBM IBM App Connect Enterprise Certified Container  11.5",
      "IBM IBM App Connect Enterprise Certified Container  11.6",
      "IBM IBM App Connect Enterprise Certified Container  12.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-22491",
  "serverity": "\u4e2d",
  "submitTime": "2025-02-08",
  "title": "IBM App Connect Enterprise Certified Container\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2025-02814\uff09"
}

CVE-2022-22491 (GCVE-0-2022-22491)

Vulnerability from cvelistv5 – Published: 2025-01-09 14:11 – Updated: 2025-01-09 14:22

Summary

IBM App Connect Enterprise Certified Container 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, and 12.4 operands running in Red Hat OpenShift do not restrict writing to the local filesystem, which may result in exhausting the available storage in a Pod, resulting in that Pod being restarted.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7180500

Impacted products

	Vendor	Product	Version
	IBM	App Connect Enterprise Certified Container	Affected: 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4 cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.3:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.4:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.5:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.6:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.3:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.4:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-22491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T14:21:17.281118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T14:22:35.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "App Connect Enterprise Certified Container",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM App Connect Enterprise Certified Container\u0026nbsp;7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, and 12.4 operands running in Red Hat OpenShift do not restrict writing to the local filesystem, which may result in exhausting the available storage in a Pod, resulting in that Pod being restarted."
            }
          ],
          "value": "IBM App Connect Enterprise Certified Container\u00a07.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, and 12.4 operands running in Red Hat OpenShift do not restrict writing to the local filesystem, which may result in exhausting the available storage in a Pod, resulting in that Pod being restarted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-09T14:11:28.233Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "url": "https://www.ibm.com/support/pages/node/7180500"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM App Connect Enterprise Certified Container denial of service",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2022-22491",
    "datePublished": "2025-01-09T14:11:28.233Z",
    "dateReserved": "2022-01-03T22:29:21.009Z",
    "dateUpdated": "2025-01-09T14:22:35.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-02814

CVE-2022-22491 (GCVE-0-2022-22491)

Tags

Sightings

Nomenclature