Is The Gateway Vulnerable to CVE-2023-4863

Products

• CA API Gateway

Issue/Introduction

Vulnerability CVE-2023-4863 indicates the following: A heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Is the gateway vulnerable to this CVE ?

Environment

CA API Gateway 10.1, 11.0

Resolution

Gateway 10.1 is not impacted by this vulnerability and no action is required.

This is addressed within Gateway 11.0 with our September 2023 monthly platform patch.  Apply any MPP later than September 2023 to remedy this vulnerability within Gateway 11.0

You can obtain the latest version of our MPP from our solution and patches page.