Cloud Pak For Data System
Monthly
Log injection in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows unauthenticated remote actors to insert forged or malformed entries into application log files by supplying input containing special characters such as CRLF sequences that are written to logs without sanitization. The integrity impact is limited to log tampering - attackers cannot read data, escalate privileges, or disrupt service through this flaw alone, but forged log records can mislead incident responders and undermine audit-trail integrity. No public exploit has been identified at time of analysis, and IBM has released a patch via its support portal.
Local denial-of-service in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows a local attacker to exhaust system resources and render the platform unavailable, without requiring any credentials. The vulnerability stems from improper resource allocation controls (CWE-770), meaning the system places no effective cap on resource consumption triggered by local access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.
Log injection in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows unauthenticated remote actors to insert forged or malformed entries into application log files by supplying input containing special characters such as CRLF sequences that are written to logs without sanitization. The integrity impact is limited to log tampering - attackers cannot read data, escalate privileges, or disrupt service through this flaw alone, but forged log records can mislead incident responders and undermine audit-trail integrity. No public exploit has been identified at time of analysis, and IBM has released a patch via its support portal.
Local denial-of-service in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows a local attacker to exhaust system resources and render the platform unavailable, without requiring any credentials. The vulnerability stems from improper resource allocation controls (CWE-770), meaning the system places no effective cap on resource consumption triggered by local access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.