IBM fixes several vulnerabilities in Sterling Secure Proxy.

IBM has fixed several vulnerabilities in IBM Sterling Secure Proxy, mostly related to denial of service and information disclosure. The severity of the vulnerability varies between 4.5 to 9.8

IBM Sterling Secure Proxy is a DMZ-based software proxy application that provides secure high-speed data transfer, perimeter security, and protection against unauthorized access to critical business-internal systems. 

CVE-2022-40609 was one of the vulnerabilities that IBM patched in the security patch related to arbitrary code execution. A remote attacker can exploit this vulnerability by sending crafted data. It exists due to an unsafe deserialization flaw and has a severity of 9.8.

An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the JSSE component could allow an unauthenticated attacker to cause a high confidentiality and integrity impact.

As mentioned by IBM, the vulnerabilities with the highest severity among the DoS vulnerabilities were CVE-2023-24998 and CVE-2022-45685.

CVE-2023-24998 affected Apache Commons FileUpload and Tomcat, which exists due to no rate limiting on the number of requested parts that affects the file upload function. An attacker can send a specially crafted request to this function, which could result in a Denial of Service condition.

CVE-2022-45685 is a stack-based buffer overflow vulnerability that can be exploited by sending an overly long string on the JSON data that could result in a denial of service condition. This vulnerability affects Jettison.

Products affected by these vulnerabilities include IBM Sterling Secure Proxy 6.0.3 and 6.1.0. Follow the highlighted link to fix it