DX UIM CVE-2023-25690 and CVE-2023-27522

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

CVE-2023-25690 and CVE-2023-27522 was published in the National Vulnerability Database  on the 7th or March, 2023.

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_ This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55

These vulnerabilities are applicable for APACHE HTTP Server and  applicable to our wasp for tomcat 

 

 

Environment

Release : 20.4

Cause

Security vulnerability concern

Resolution

Broadcom Engineering has confirmed that UIM  is not  affected with this vulnerability. Scanning the UIM and OC installer  (wasp and other webapps) does not list any of the  Apache HTTP server related  libraries which we are  currently using .