Curl Vulnerability (CVE-2023-38545 & CVE-2023-38546) for EEM

Products

• CA Service Desk Manager
• CA Service Management - Service Desk Manager
• CA Service Catalog
• CA Application Performance Management (APM / Wily / Introscope)
• CA Service Operations Insight (SOI)
• CA Process Automation Base
• CA Harvest Software Change Manager
• CA Configuration Automation

Issue/Introduction

A high severity vulnerability found in the curl library (libcurl) which is used in EEM

Environment

Releases: v12.6.3.0, 12.6.4.0, 12.6.5.0, 12.6.6.0

Resolution

CVE-2023-38545 - Based on the initial review on the usage of the libcurl, EEM is not using SOCKS5 proxy for connecting to remote hosts. While the version used is vulnerable, they are not exploitable since SOCKS5 proxy is not enabled.

CVE-2023-38546 - EEM is not impacted by CVE-2023-38546. EEM's use of the libcurl API does not meet the specific set of conditions that would allow an attacker to exploit this vulnerability.