IBM has patched 57 vulnerabilities in its Process Mining software, which is used by businesses to analyse workflows.
The flaws were inherited from FasterXML jackson-databind, a third-party package that allows JSON material to be read into Java Objects and JSON Trees.
Big Blue has taken its time to catch up; the flaws were discovered between 2018 and 2020, and Oracle fixed some of them in 2019.
There are 38 vulnerabilities with a Common Vulnerabilities Scoring System (CVSS) score of 9.8 and no known workarounds, according to IBM.
The majority of the most serious flaws are caused by serialisation failures, most commonly “an unsafe deserialization between gadgets and typing,” which damage many programme components.
There are also concerns with “polymorphic type” and deserialization within software components.
The flaws allow attackers to send specially crafted inputs to the system, resulting in arbitrary code execution.
Version 1.12.0.4 of IBM Process Mining is required for all users.
