IBM workflow analysis software beset by bugs

IBM has moved to fix 57 vulnerabilities in its Process Mining software, used by enterprises to conduct workflow analysis. 

The vulnerabilities were inherited from a third-party package, FasterXML jackson-databind, which allows JSON content to be read into Java Objects and JSON Trees.

It’s taken some time for Big Blue to catch up; the vulnerabilities were reported between 2018 and 2020, and some were patched by Oracle back in 2019.

There are 38 of the vulnerabilities which carry a Common Vulnerabilities Scoring System (CVSS) score of 9.8, and IBM reports there are no known workarounds.

Most of the most severe bugs relate to serialisation errors, most often “an unsafe deserialisation between gadgets and typing” affecting various components of the software.

There are also “polymorphic typing” issues, and deserialisation issues within components of the software.

The vulnerabilities allow attackers to send crafted inputs to the system for arbitrary code execution.

Users of IBM Process Mining need to upgrade to version version 1.12.0.4.