logo
DATABASE RESOURCES PRICING ABOUT US

Security Bulletin: Multiple security vulnerabilities fixed in Cloud Pak for Automation components

2022-01-19T16:26:59

Description

## Summary Cloud Pak for Automation has released cummulative security fixes addressing vulnerabilities in several of its components. ## Vulnerability Details **CVEID: **[CVE-2021-37701](<https://vulners.com/cve/CVE-2021-37701>) **DESCRIPTION: **Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by an arbitrary file creation/overwrite vulnerability. By creating a directory, and then replacing that directory with a symlink, an attacker could use an untrusted tar file to symlink into an arbitrary location and extract arbitrary files into that location to create or overwrite arbitrary files and execute arbitrary code on the system. CVSS Base score: 8.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208442](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208442>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) **CVEID: **[CVE-2021-23840](<https://vulners.com/cve/CVE-2021-23840>) **DESCRIPTION: **OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could exploit this vulnerability to cause the application to crash. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/196848](<https://exchange.xforce.ibmcloud.com/vulnerabilities/196848>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-23841](<https://vulners.com/cve/CVE-2021-23841>) **DESCRIPTION: **OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in the X509_issuer_and_serial_hash() function. By parsing the issuer field, an attacker could exploit this vulnerability to cause the application to crash. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/196847](<https://exchange.xforce.ibmcloud.com/vulnerabilities/196847>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-2341](<https://vulners.com/cve/CVE-2021-2341>) **DESCRIPTION: **An unspecified vulnerability in Java SE related to the Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. CVSS Base score: 3.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205768](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205768>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) **CVEID: **[CVE-2021-35065](<https://vulners.com/cve/CVE-2021-35065>) **DESCRIPTION: **Node.js glob-parent module is vulnerable to a denial of service, caused by an error in the enclosure regex. By sending a specially crafted string prepended with the letter "A", a remote attacker could exploit this vulnerability to cause a regular expression denial of service. CVSS Base score: 5.9 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208298](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208298>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-22939](<https://vulners.com/cve/CVE-2021-22939>) **DESCRIPTION: **Node.js could allow a remote attacker to bypass security restrictions. If the https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, an attacker could exploit this vulnerability to connect to servers using an expired certificate. CVSS Base score: 3.7 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/207233](<https://exchange.xforce.ibmcloud.com/vulnerabilities/207233>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) **CVEID: **[CVE-2021-29753](<https://vulners.com/cve/CVE-2021-29753>) **DESCRIPTION: **IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. CVSS Base score: 5.9 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/201919](<https://exchange.xforce.ibmcloud.com/vulnerabilities/201919>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) **CVEID: **[CVE-2021-37713](<https://vulners.com/cve/CVE-2021-37713>) **DESCRIPTION: **Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by insufficient logic on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target. An attacker could exploit this vulnerability to create or overwrite arbitrary files and execute arbitrary code on the system. CVSS Base score: 8.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208451](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208451>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) **CVEID: **[CVE-2021-35517](<https://vulners.com/cve/CVE-2021-35517>) **DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocating large amounts of memory. By persuading a victim to open a specially-crafted TAR archive, a remote attacker could exploit this vulnerability to cause a denial of service condition against services that use Compress' tar package. CVSS Base score: 5.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205307](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205307>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-36090](<https://vulners.com/cve/CVE-2021-36090>) **DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By reading a specially-crafted ZIP archive, a remote attacker could exploit this vulnerability to cause a denial of service condition against services that use Compress' zip package. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205310](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205310>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-3749](<https://vulners.com/cve/CVE-2021-3749>) **DESCRIPTION: **axios is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the trim function. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause an application to consume an excessive amount of CPU. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208438](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208438>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-22940](<https://vulners.com/cve/CVE-2021-22940>) **DESCRIPTION: **Node.js could allow a remote attacker to bypass security restrictions, caused by an incomplete fix for CVE-2021-22930 related to a use-after-free on close http2 on stream canceling. An attacker could exploit this vulnerability to corrupt memory to change process behavior. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/207520](<https://exchange.xforce.ibmcloud.com/vulnerabilities/207520>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) **CVEID: **[CVE-2021-22930](<https://vulners.com/cve/CVE-2021-22930>) **DESCRIPTION: **Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on close http2 on stream canceling. An attacker could exploit this vulnerability to corrupt memory to change process behavior. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/206473](<https://exchange.xforce.ibmcloud.com/vulnerabilities/206473>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) **CVEID: **[CVE-2021-33574](<https://vulners.com/cve/CVE-2021-33574>) **DESCRIPTION: **GNU C Library (aka glibc) is vulnerable to a denial of service, caused by a use-after-free flaw in the mq_notify function. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause the application to crash. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202550](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202550>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2019-20838](<https://vulners.com/cve/CVE-2019-20838>) **DESCRIPTION: **PCRE is vulnerable to a denial of service, caused by a buffer over-read in JIT. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause the application to crash. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/185645](<https://exchange.xforce.ibmcloud.com/vulnerabilities/185645>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2020-14155](<https://vulners.com/cve/CVE-2020-14155>) **DESCRIPTION: **PCRE could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in libpcre. By sending a request with a large number, an attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. CVSS Base score: 7.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/183499](<https://exchange.xforce.ibmcloud.com/vulnerabilities/183499>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) **CVEID: **[CVE-2021-27218](<https://vulners.com/cve/CVE-2021-27218>) **DESCRIPTION: **GNOME GLib is vulnerable to a denial of service, caused by an error when invoking g_byte_array_new_take() with a buffer of 4GB or more on a 64-bit platform. An attacker could exploit this vulnerability to cause unintended length truncation. CVSS Base score: 6.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/196784](<https://exchange.xforce.ibmcloud.com/vulnerabilities/196784>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-28153](<https://vulners.com/cve/CVE-2021-28153>) **DESCRIPTION: **GNOME GLib could allow a remote attacker to bypass security restrictions, caused by a flaw when g_file_replace() function is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink. By persuading a victim to open a specially-crafted ZIP archive, an attacker could exploit this vulnerability to overwrite arbitrary files on the sytem. CVSS Base score: 5.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198147](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198147>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) **CVEID: **[CVE-2021-3421](<https://vulners.com/cve/CVE-2021-3421>) **DESCRIPTION: **RPM Project RPM could allow a remote attacker to bypass security restrictions, caused by a flaw in the read function. By persuading a victim to install a seemingly verifiable package or compromise an RPM repository, an attacker could exploit this vulnerability to cause a corruption to the RPM database. CVSS Base score: 6.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/203124](<https://exchange.xforce.ibmcloud.com/vulnerabilities/203124>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) **CVEID: **[CVE-2021-20266](<https://vulners.com/cve/CVE-2021-20266>) **DESCRIPTION: **RPM Project RPM is vulnerable to a denial of service, caused by an out-of-bounds read flaw in the hdrblobInit function in lib/header.c. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. CVSS Base score: 3.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/201041](<https://exchange.xforce.ibmcloud.com/vulnerabilities/201041>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) **CVEID: **[CVE-2021-3445](<https://vulners.com/cve/CVE-2021-3445>) **DESCRIPTION: **libdnf could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in signature verification functionality. By placing a signature in the main header, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 6.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/203146](<https://exchange.xforce.ibmcloud.com/vulnerabilities/203146>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2021-3517](<https://vulners.com/cve/CVE-2021-3517>) **DESCRIPTION: **GNOME libxml2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by xmlEncodeEntitiesInternal() in entities.c. By sending a specially crafted file, a remote attacker could trigger an out-of-bounds read and execute arbitrary code on the system or cause a denial of service. CVSS Base score: 8.6 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202526](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202526>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) **CVEID: **[CVE-2021-3516](<https://vulners.com/cve/CVE-2021-3516>) **DESCRIPTION: **libxml2 could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in xmlEncodeEntitiesInternal() in entities.c. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 7.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202838](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202838>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2021-3518](<https://vulners.com/cve/CVE-2021-3518>) **DESCRIPTION: **GNOME libxml2 could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free flaw in the xmlXIncludeDoProcess() function in xinclude.c. By sending a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 8.6 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/203144](<https://exchange.xforce.ibmcloud.com/vulnerabilities/203144>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) **CVEID: **[CVE-2021-3537](<https://vulners.com/cve/CVE-2021-3537>) **DESCRIPTION: **GNOME libxml2 is vulnerable to a denial of service, caused by a NULL pointer dereference flaw when parsing XML mixed content in recovery mode and post-validated. A remote attacker could exploit this vulnerability to cause the application to crash. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/203084](<https://exchange.xforce.ibmcloud.com/vulnerabilities/203084>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-20231](<https://vulners.com/cve/CVE-2021-20231>) **DESCRIPTION: **GnuTLS is vulnerable to a denial of service, caused by a use-after-free issue in client sending key_share extension. By sending a specially-crafted request, an attacker could exploit this vulnerability to cause memory corruption and other consequences. CVSS Base score: 7.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198173](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198173>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) **CVEID: **[CVE-2021-20232](<https://vulners.com/cve/CVE-2021-20232>) **DESCRIPTION: **GnuTLS is vulnerable to a denial of service, caused by a use-after-free issue in client_send_params in lib/ext/pre_shared_key.c. By sending a specially-crafted request, an attacker could exploit this vulnerability to cause memory corruption and other consequences. CVSS Base score: 7.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198172](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198172>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) **CVEID: **[CVE-2020-16135](<https://vulners.com/cve/CVE-2020-16135>) **DESCRIPTION: **Libssh is vulnerable to a denial of service, caused by a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL. A remote attacker could exploit this vulnerability to cause the application to crash. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/186148](<https://exchange.xforce.ibmcloud.com/vulnerabilities/186148>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-22876](<https://vulners.com/cve/CVE-2021-22876>) **DESCRIPTION: **cURL libcurl could allow a remote attacker to obtain sensitive information, caused by the failure to strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests. By sending a specially-crafted HTTP request, an attacker could exploit this vulnerability to obtain user credentials, and use this information to launch further attacks against the affected system. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/199186](<https://exchange.xforce.ibmcloud.com/vulnerabilities/199186>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) **CVEID: **[CVE-2021-3200](<https://vulners.com/cve/CVE-2021-3200>) **DESCRIPTION: **Libsolv is vulnerable to a denial of service, caused by a buffer overflow in the testcase_read function. By persuading a victim to open a specially file, a remote attacker could overflow a buffer and cause the application to crash. CVSS Base score: 3.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/203837](<https://exchange.xforce.ibmcloud.com/vulnerabilities/203837>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) **CVEID: **[CVE-2021-2388](<https://vulners.com/cve/CVE-2021-2388>) **DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to take control of the system. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205815](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205815>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2021-2369](<https://vulners.com/cve/CVE-2021-2369>) **DESCRIPTION: **An unspecified vulnerability in Java SE related to the Library component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. CVSS Base score: 4.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205796](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205796>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) **CVEID: **[CVE-2021-2432](<https://vulners.com/cve/CVE-2021-2432>) **DESCRIPTION: **An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. CVSS Base score: 3.7 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205856](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205856>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) **CVEID: **[CVE-2021-37712](<https://vulners.com/cve/CVE-2021-37712>) **DESCRIPTION: **Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by an arbitrary file creation/overwrite vulnerability. By creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, an attacker could use an untrusted tar file to symlink into an arbitrary location and extract arbitrary files into that location to create or overwrite arbitrary files and execute arbitrary code on the system. CVSS Base score: 8.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208450](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208450>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) **CVEID: **[CVE-2021-23440](<https://vulners.com/cve/CVE-2021-23440>) **DESCRIPTION: **Nodejs set-value module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 7.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/209431](<https://exchange.xforce.ibmcloud.com/vulnerabilities/209431>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) **CVEID: **[CVE-2021-22931](<https://vulners.com/cve/CVE-2021-22931>) **DESCRIPTION: **Node.js could provide weaker than expected security, caused by missing input validation on hostnames returned by DNS servers. An attacker could exploit this vulnerability to cause output of wrong hostnames leading to Domain Hijacking and and injection vulnerabilities in applications using the library. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/207230](<https://exchange.xforce.ibmcloud.com/vulnerabilities/207230>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) **CVEID: **[CVE-2021-29842](<https://vulners.com/cve/CVE-2021-29842>) **DESCRIPTION: **IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202. CVSS Base score: 3.7 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205202](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205202>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) **CVEID: **[CVE-2021-23382](<https://vulners.com/cve/CVE-2021-23382>) **DESCRIPTION: **Node.js postcss module is vulnerable to a denial of service, caused by a regular expression denial of Service (ReDoS) flaw in the getAnnotationURL() and loadAnnotation() functions in lib/previous-map.js. By sending specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service condition. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/200772](<https://exchange.xforce.ibmcloud.com/vulnerabilities/200772>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2021-32803](<https://vulners.com/cve/CVE-2021-32803>) **DESCRIPTION: **Node.js tar module could allow a local attacker to traverse directories on the system, caused by insufficient symlink protection. An attacker could use a specially-crafted tar file containing "dot dot" sequences (/../) to create or overwrite arbitrary files on the system. CVSS Base score: 8.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/206717](<https://exchange.xforce.ibmcloud.com/vulnerabilities/206717>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) ## Affected Products and Versions Affected Product(s) | Version(s) ---|--- IBM Cloud Pak for Automation | V21.0.1 V21.0.2 V21.0.3 ## Remediation/Fixes The recommended action is to upgrade to the latest cumulative security fix for your release and consider upgrading to the latest release. * [IBM Cloud Pak for Automation 21.0.1-IF007](<https://www.ibm.com/support/pages/node/6517704> "IBM Cloud Pak for Automation 21.0.1-IF007" ) * [IBM Cloud Pak for Automation 21.0.2-IF007](<https://www.ibm.com/support/pages/node/6539964> "IBM Cloud Pak for Automation 21.0.2-IF007" ) * [IBM Cloud Pak for Automation 21.0.3-IF002](<https://www.ibm.com/support/pages/node/6539966> "IBM Cloud Pak for Automation 21.0.3-IF002" ) Repackaged public images used in **demo** deployments were not updated in **21.0.1** to fix some of the reported CVEs. Create your demo environments using the latest release. CVE-2021-33574, CVE-2020-14155, CVE-2021-28153, CVE-2021-3516, CVE-2021-3517, CVE-2021-3518, CVE-2021-3537, CVE-2021-20231, CVE-2021-20232, CVE-2021-22876, CVE-2021-23840, CVE-2021-27218: * cp.icr.io/cp/cp4a/demo/openldap:1.3.0 * cp.icr.io/cp/cp4a/demo/phpldapadmin:0.9.0 * cp.icr.io/cp/cp4a/demo/gitea:1.12.3 * cp.icr.io/cp/cp4a/demo/alpine:3.6 * cp.icr.io/cp/cp4a/demo/busybox:1.32 CVE-2021-23841 is marked as "Will Not Fix" by Red Hat, see <https://access.redhat.com/security/cve/CVE-2021-23841> and is reported for **all images**. The vulnerable function is never invoked by openSSL itself, hence openSSL is not affected. There is no use case in Cloud Pak for Automation to invoke openSSL for signing a certificate with user provided input for the issuer field. Based on current information, we share this assessment for Cloud Pak for Automation. CVE-2020-16135 is not yet included in Red Hat Universal Base Image and is reported for **all images**. It is rated low severity and will be picked up with future security updates. CVE-2021-37712, CVE-2021-37713, and CVE-2021-37701 are fixed in a shared Node JS docker layer and hence fixed for all components building on top of it. The **IBM ****Advanced Document Processing (IADP) component in 21.0.3 **packages its own copy of Node JS and has not included fixes for these CVEs. Based on current information, IADP is assessed as not affected, due the application specific use of this library: * cp.icr.io/cp/cp4a/iadp/backend:21.0.3-IF002 The **IBM ****Advanced Document Processing (IADP) component in 21.0.1** builds upon Red Hat Universal Base Image 7.x and cannot be upgraded. The following CVEs have not been addressed for this component. The only mitigation is to upgrade to 21.0.2 or later when using any of the IADP images: CVE-2021-33574, CVE-2020-14155, CVE-2021-27218, CVE-2021-28153, CVE-2021-3421, CVE-2021-20266, CVE-2021-3516, CVE-2021-3517, CVE-2021-3518, CVE-2021-3537, CVE-2021-22876 * cp.icr.io/cp/cp4a/iadp/rabbitmq:21.0.1-IF007 * cp.icr.io/cp/cp4a/iadp/redis:21.0.1-IF007 * cp.icr.io/cp/cp4a/iadp/natural_language_extractor:21.0.1-IF007 * cp.icr.io/cp/cp4a/iadp/deep_learning:21.0.1-IF007 * cp.icr.io/cp/cp4a/iadp/viewone:21.0.1-IF007 * cp.icr.io/cp/cp4a/iadp/cdra:21.0.1-IF007 * cp.icr.io/cp/cp4a/iadp/cpds:21.0.1-IF007 * cp.icr.io/cp/cp4a/iadp/cds:21.0.1-IF007 * cp.icr.io/cp/cp4a/iadp/gitgateway:21.0.1-IF007 ## Workarounds and Mitigations None ##


Affected Software


CPE Name Name Version
ibm cloud pak for automation any

Related


ibm
software

Security Bulletin: Vulnerabilities in Node.js, IBM WebSphere Application Server Liberty, and OpenSSL affect IBM Spectrum Control

2021-12-09T07:56:22
ibm
software

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities

2021-10-22T14:03:57
ibm
software

Security Bulletin: IBM Event Streams UI affected by multiple node package vulnerabilities

2021-12-21T17:39:35
ibm
software

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js

2021-10-29T21:37:31
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Business Developer

2021-11-09T16:19:35
ibm
software

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

2021-09-13T11:17:27
ibm
software

Security Bulletin: Multiple security vulnerabilities have been identified in IBM® Java SDK that affect IBM Security Directory Suite - July 2021 CPU

2022-02-08T19:39:24
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Functional Tester

2021-09-29T07:32:04
ibm
software

Security Bulletin: IBM Kenexa LMS On Premise -IBM SDK, Java Technology Edition Quarterly CPU - Jul 2021 - Includes Oracle Jul 2021 CPU (minus CVE-2021-2341)

2021-09-28T08:11:26
ibm
software

Security Bulletin: IBM SDK, Java Tech Edition Quarterly CPU Jul 2021 - Includes Oracle Jul 2021 CPU (minus CVE-2021-2341)

2021-09-22T23:29:34
ibm
software

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager CVE-2021-2388, CVE-2021-2369, CVE-2021-2432, CVE-2021-2341.

2021-10-18T06:29:01
ibm
software

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager CVE-2021-2388, CVE-2021-2369, CVE-2021-2432, CVE-2021-2341.

2021-10-18T06:29:32
ibm
software

Security Bulletin: IBM SDK, Java Tech Edition Quarterly CPU Jul 2021 - Includes Oracle Jul 2021 CPU (minus CVE-2021-2341)

2021-09-23T00:10:48
ibm
software

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - July 2021 - Includes Oracle July 2021 CPU minus CVE-2021-2341 affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

2021-10-30T14:41:35
ibm
software

Security Bulletin: Open Source Dependency Vulnerability

2023-05-15T18:33:20
ibm
software

Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server & WAS Liberty is vulnerable to Information Exposure

2022-03-31T06:39:36
ibm
software

Security Bulletin: Multiple vulnerabilities in WebSphere Application Server Liberty affect IBM InfoSphere Information Server

2022-04-27T23:07:49
ibm
software

Security Bulletin: A vulnerability in Liberty affects IBM WIoTP MessageGateway (CVE-2021-29842)

2021-12-24T16:01:38
ibm
software

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

2021-10-01T06:17:41
ibm
software

Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities

2022-12-05T19:00:57
ibm
software

Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM)

2021-09-28T07:16:03
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional

2021-11-16T09:01:23
ibm
software

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime Affect IBM Connect:Direct Web Services

2021-11-10T15:02:52
ibm
software

Security Bulletin: Multiple Vulnerabilities in IBM Sterling Connect:Direct Browser User Interface

2021-11-10T15:04:02
ibm
software

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Tivoli Netcool Impact (CVE-2021-2388, CVE-2021-2369, CVE-2021-2432)

2021-11-08T13:09:37
ibm
software

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

2021-10-28T23:13:27
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Application Server July 2021 CPU that is bundled with IBM WebSphere Application Server Patterns

2021-09-10T19:47:59
ibm
software

Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Java version used in it.(CVE-2021-2388, CVE-2021-2369, CVE-2021-2432)

2022-01-17T19:26:54
ibm
software

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Java (Multiple CVEs)

2022-04-22T18:46:59
ibm
software

Security Bulletin: Multiple vulnerabilities found in IBM MQ and Java 8 which is shipped with IBM® Intelligent Operations Center(CVE-2021-2388, CVE-2021-2369, CVE-2021-2432)

2022-09-08T06:08:02
ibm
software

Security Bulletin: Security Vulnerabilities in IBM® Java SDK July 2021 CPU affect multiple IBM Continuous Engineering products based on IBM Jazz Technology

2021-09-14T20:07:42
ibm
software

Security Bulletin: September 2021 :Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

2021-12-09T16:57:12
ibm
software

Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud

2022-10-07T16:01:56
ibm
software

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jul 2021 - Includes Oracle Jul 2021 CPU

2021-10-08T07:52:16
ibm
software

Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple IBM Java Runtime vulnerabilities

2022-12-05T19:00:57
ibm
software

Security Bulletin: Vulnerabilities in IBM Java SDK affecting IBM Application Discovery and Delivery Intelligence V5.1.0.7

2021-11-01T18:20:00
ibm
software

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring

2022-12-30T17:31:59
ibm
software

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java

2021-11-30T16:27:57
ibm
software

Security Bulletin: IBM Sterling Connect:Direct for UNIX Certified Container is affected by multiple vulnerabilities in Red Hat Universal Base Image version 8.4-206.1626828523 and Binutils version 2.30-93

2022-03-14T20:12:12
nessus
scanner

FreeBSD : Node.js -- August 2021 Security Releases (b092bd4f-1b16-11ec-9d9d-0022489ad614)

2021-10-01T00:00:00
nessus
scanner

SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2021:1654-1)

2021-05-20T00:00:00
nessus
scanner

openSUSE Security Update : libxml2 (openSUSE-2021-764)

2021-05-25T00:00:00
nessus
scanner

Debian DLA-2653-1 : libxml2 security update

2021-05-11T00:00:00
nessus
scanner

SUSE SLES12 Security Update : libxml2 (SUSE-SU-2021:1658-1)

2021-05-20T00:00:00
nessus
scanner

Oracle Java SE 1.7.0_311 / 1.8.0_301 / 1.11.0_12 / 1.16.0_2 Multiple Vulnerabilities (July 2021 CPU)

2021-07-23T00:00:00
nessus
scanner

OpenJDK 7 <= 7u301 / 8 <= 8u292 / 11.0.0 <= 11.0.11 / 13.0.0 <= 13.0.7 / 15.0.0 <= 15.0.3 / 16.0.0 <= 16.0.1 Multiple Vulnerabilities (2021-07-20)

2021-07-21T00:00:00
nessus
scanner

IBM Java 7.0 < 7.0.11.0 / 7.1 < 7.1.5.0 / 8.0 < 8.0.6.35 / 11.0 < 11.0.12 Multiple Vulnerabilities

2022-04-29T00:00:00
nessus
scanner

Azul Zulu Java Multiple Vulnerabilities (2021-07-20)

2021-10-11T00:00:00
nessus
scanner

Oracle Java SE 1.7.0_311 / 1.8.0_301 / 1.11.0_12 / 1.16.0_2 Multiple Vulnerabilities (Unix July 2021 CPU)

2021-07-23T00:00:00
nessus
scanner

SUSE SLES15 Security Update : nodejs14 (SUSE-SU-2021:3211-1)

2021-09-24T00:00:00
nessus
scanner

openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2021:1313-1)

2021-09-29T00:00:00
nessus
scanner

SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2021:2824-1)

2021-08-25T00:00:00
nessus
scanner

SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2021:3184-1)

2021-09-23T00:00:00
nessus
scanner

openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2021:3211-1)

2021-09-24T00:00:00
nessus
scanner

SUSE SLES15 Security Update : nodejs12 (SUSE-SU-2021:2875-1)

2021-08-31T00:00:00
nessus
scanner

openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2021:1214-1)

2021-09-01T00:00:00
nessus
scanner

openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2021:2875-1)

2021-09-02T00:00:00
nessus
scanner

Node.js Multiple Vulnerabilities (August 2021 Security Releases)

2021-10-19T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.6.6 : libxml2 (EulerOS-SA-2022-1131)

2022-02-13T00:00:00
nessus
scanner

EulerOS 2.0 SP8 : libxml2 (EulerOS-SA-2021-2306)

2021-08-10T00:00:00
nessus
scanner

AlmaLinux 8 : libxml2 (ALSA-2021:2569)

2022-02-09T00:00:00
nessus
scanner

EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2021-2249)

2021-08-09T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.6.0 : libxml2 (EulerOS-SA-2022-1082)

2022-02-12T00:00:00
nessus
scanner

EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2021-2406)

2021-09-14T00:00:00
nessus
scanner

Oracle Linux 8 : libxml2 (ELSA-2021-2569)

2021-07-03T00:00:00
nessus
scanner

EulerOS 2.0 SP3 : libxml2 (EulerOS-SA-2021-2595)

2021-10-25T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.2.6 : libxml2 (EulerOS-SA-2021-2884)

2022-01-06T00:00:00
nessus
scanner

EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2021-2275)

2021-08-09T00:00:00
nessus
scanner

RHEL 8 : libxml2 (RHSA-2021:2569)

2021-06-29T00:00:00
nessus
scanner

CentOS 8 : libxml2 (CESA-2021:2569)

2021-07-03T00:00:00
nessus
scanner

Rocky Linux 8 : libxml2 (RLSA-2021:2569)

2022-02-09T00:00:00
nessus
scanner

Amazon Linux 2 : libxml2 (ALAS-2021-1677)

2021-07-01T00:00:00
nessus
scanner

CentOS 8 : nodejs:14 (CESA-2021:3666)

2021-09-27T00:00:00
nessus
scanner

Oracle Linux 8 : nodejs:14 (ELSA-2021-3666)

2021-09-27T00:00:00
nessus
scanner

CentOS 8 : nodejs:12 (CESA-2021:3623)

2021-09-22T00:00:00
nessus
scanner

Oracle Linux 8 : nodejs:12 (ELSA-2021-3623)

2021-09-22T00:00:00
nessus
scanner

RHEL 8 : nodejs:12 (RHSA-2021:3623)

2021-09-21T00:00:00
nessus
scanner

RHEL 8 : nodejs:14 (RHSA-2021:3666)

2021-09-27T00:00:00
nessus
scanner

SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2021:1523-1)

2021-05-07T00:00:00
nessus
scanner

openSUSE Security Update : libxml2 (openSUSE-2021-692)

2021-05-18T00:00:00
nessus
scanner

SUSE SLES12 Security Update : libxml2 (SUSE-SU-2021:1524-1)

2021-05-07T00:00:00
nessus
scanner

Photon OS 2.0: Libxml2 PHSA-2021-2.0-0351

2021-06-10T00:00:00
nessus
scanner

Photon OS 3.0: Libxml2 PHSA-2021-3.0-0246

2021-06-04T00:00:00
nessus
scanner

Photon OS 4.0: Libxml2 PHSA-2021-4.0-0035

2021-06-04T00:00:00
nessus
scanner

Oracle Linux 8 : java-11-openjdk (ELSA-2021-2781)

2021-07-22T00:00:00
nessus
scanner

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x i686/x86_64 (2021:2845)

2021-07-26T00:00:00
nessus
scanner

Oracle Linux 7 : java-11-openjdk (ELSA-2021-2784)

2021-07-22T00:00:00
nessus
scanner

RHEL 8 : java-11-openjdk (RHSA-2021:2781)

2021-07-21T00:00:00
nessus
scanner

SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2021:2952-1)

2021-09-04T00:00:00
nessus
scanner

Debian DLA-2737-1 : openjdk-8 - LTS security update

2021-08-10T00:00:00
nessus
scanner

EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2021-2501)

2021-09-27T00:00:00
nessus
scanner

CentOS 7 : java-11-openjdk (CESA-2021:2784)

2021-07-22T00:00:00
nessus
scanner

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2021:2784)

2021-07-26T00:00:00
nessus
scanner

Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2021-2776)

2021-07-22T00:00:00
nessus
scanner

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1692)

2021-07-22T00:00:00
nessus
scanner

CentOS 8 : java-1.8.0-openjdk (CESA-2021:2776)

2021-07-25T00:00:00
nessus
scanner

EulerOS 2.0 SP8 : java-1.8.0-openjdk (EulerOS-SA-2021-2464)

2021-09-24T00:00:00
nessus
scanner

openSUSE 15 Security Update : java-11-openjdk (openSUSE-SU-2021:1233-1)

2021-09-08T00:00:00
nessus
scanner

Debian DSA-4946-1 : openjdk-11 - security update

2021-07-30T00:00:00
nessus
scanner

openSUSE 15 Security Update : java-11-openjdk (openSUSE-SU-2021:2952-1)

2021-09-04T00:00:00
nessus
scanner

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1695)

2021-09-08T00:00:00
nessus
scanner

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2021-2845)

2021-07-22T00:00:00
nessus
scanner

AlmaLinux 8 : java-1.8.0-openjdk (ALSA-2021:2776)

2022-02-09T00:00:00
nessus
scanner

Amazon Corretto Java 8.x < 8.302.08.1 Multiple Vulnerabilities

2022-04-01T00:00:00
nessus
scanner

Amazon Corretto Java 11.x < 11.0.12.7.1 Multiple Vulnerabilities

2022-04-01T00:00:00
nessus
scanner

RHEL 8 : java-1.8.0-openjdk (RHSA-2021:2774)

2021-07-21T00:00:00
nessus
scanner

RHEL 8 : java-1.8.0-openjdk (RHSA-2021:2775)

2021-07-21T00:00:00
nessus
scanner

RHEL 8 : java-1.8.0-openjdk (RHSA-2021:2776)

2021-07-21T00:00:00
nessus
scanner

RHEL 8 : java-11-openjdk (RHSA-2021:2782)

2021-07-21T00:00:00
nessus
scanner

RHEL 8 : java-11-openjdk (RHSA-2021:2783)

2021-07-21T00:00:00
nessus
scanner

RHEL 7 : java-11-openjdk (RHSA-2021:2784)

2021-07-21T00:00:00
nessus
scanner

SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2021:2613-1)

2021-08-06T00:00:00
nessus
scanner

CentOS 8 : java-11-openjdk (CESA-2021:2781)

2021-07-25T00:00:00
nessus
scanner

Rocky Linux 8 : java-1.8.0-openjdk (RLSA-2021:2776)

2022-02-09T00:00:00
nessus
scanner

CentOS 7 : java-1.8.0-openjdk (CESA-2021:2845)

2021-08-11T00:00:00
nessus
scanner

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1528)

2021-09-09T00:00:00
nessus
scanner

RHEL 7 : java-1.8.0-openjdk (RHSA-2021:2845)

2021-07-22T00:00:00
nessus
scanner

Rocky Linux 8 : java-11-openjdk (RLSA-2021:2781)

2022-02-09T00:00:00
nessus
scanner

AlmaLinux 8 : java-11-openjdk (ALSA-2021:2781)

2022-02-09T00:00:00
nessus
scanner

Amazon Corretto Java 16.x < 16.0.2.7.1 Multiple Vulnerabilities

2022-04-01T00:00:00
nessus
scanner

RHEL 7 : java-1.7.1-ibm (RHSA-2021:3293)

2021-08-30T00:00:00
nodejsblog
software

August 2021 Security Releases

2021-08-11T00:00:00
freebsd
unix

Node.js -- August 2021 Security Releases

2021-08-11T00:00:00
photon
unix

Critical Photon OS Security Update - PHSA-2021-0035

2021-06-02T00:00:00
photon
unix

Critical Photon OS Security Update - PHSA-2021-4.0-0035

2021-06-02T00:00:00
photon
unix

Critical Photon OS Security Update - PHSA-2021-0241

2021-05-21T00:00:00
photon
unix

Critical Photon OS Security Update - PHSA-2021-3.0-0241

2021-05-21T00:00:00
photon
unix

Important Photon OS Security Update - PHSA-2021-0399

2021-05-31T00:00:00
photon
unix

Critical Photon OS Security Update - PHSA-2021-0090

2021-08-27T00:00:00
photon
unix

Critical Photon OS Security Update - PHSA-2021-4.0-0090

2021-08-27T00:00:00
debian
unix

[SECURITY] [DLA 2653-1] libxml2 security update

2021-05-10T12:31:54
debian
unix

[SECURITY] [DLA 2737-1] openjdk-8 security update

2021-08-09T19:27:32
debian
unix

[SECURITY] [DSA 4946-1] openjdk-11 security update

2021-07-29T18:44:34
suse
unix

Security update for libxml2 (important)

2021-05-22T00:00:00
suse
unix

Security update for nodejs14 (important)

2021-09-28T00:00:00
suse
unix

Security update for nodejs14 (important)

2021-09-23T00:00:00
suse
unix

Security update for nodejs12 (important)

2021-08-31T00:00:00
suse
unix

Security update for nodejs12 (important)

2021-08-30T00:00:00
suse
unix

Security update for libxml2 (moderate)

2021-05-09T00:00:00
suse
unix

Security update for java-11-openjdk (important)

2021-09-07T00:00:00
suse
unix

Security update for java-11-openjdk (important)

2021-09-03T00:00:00
osv
software

libxml2 - security update

2021-05-10T00:00:00
osv
software

openjdk-8 - security update

2021-08-09T00:00:00
osv
software

openjdk-11 - security update

2021-07-29T00:00:00
fedora
unix

[SECURITY] Fedora 34 Update: libxml2-2.9.10-12.fc34

2021-05-10T01:07:26
fedora
unix

[SECURITY] Fedora 33 Update: libxml2-2.9.12-4.fc33

2021-06-14T01:22:50
fedora
unix

[SECURITY] Fedora 34 Update: java-11-openjdk-11.0.12.0.7-0.fc34

2021-08-01T04:05:21
fedora
unix

[SECURITY] Fedora 33 Update: java-11-openjdk-11.0.12.0.7-0.fc33

2021-08-01T04:05:00
fedora
unix

[SECURITY] Fedora 33 Update: java-1.8.0-openjdk-1.8.0.302.b08-0.fc33

2021-08-01T04:05:00
fedora
unix

[SECURITY] Fedora 34 Update: java-1.8.0-openjdk-1.8.0.302.b08-0.fc34

2021-08-01T04:05:20
mageia
unix

Updated libxml2 packages fix security vulnerabilities

2021-05-19T19:29:59
mageia
unix

Updated nodejs packages fix security vulnerability

2021-10-06T19:41:56
mageia
unix

Updated nodejs-tar packages fix security vulnerability

2022-03-21T20:18:30
f5
software

OpenJDK vulnerabilities CVE-2021-2341, CVE-2021-2369, CVE-2021-2388, CVE-2021-2432

2022-08-22T04:28:00
kaspersky
info

KLA12237 Multiple vulnerabilities in Oracle Java SE

2021-07-20T00:00:00
altlinux
unix

Security fix for the ALT Linux 10 package libxml2 version 1:2.9.12-alt1

2021-06-15T00:00:00
almalinux
unix

Moderate: libxml2 security update

2021-06-29T13:42:19
almalinux
unix

Important: nodejs:12 security and bug fix update

2021-09-21T12:33:58
almalinux
unix

Important: nodejs:14 security and bug fix update

2021-09-27T06:47:35
almalinux
unix

Important: java-11-openjdk security update

2021-07-21T07:28:55
almalinux
unix

Important: java-1.8.0-openjdk security update

2021-07-21T07:31:58
rocky
unix

libxml2 security update

2021-06-29T13:42:19
rocky
unix

nodejs:12 security and bug fix update

2021-09-21T12:33:58
rocky
unix

nodejs:14 security and bug fix update

2021-09-27T06:47:35
rocky
unix

java-1.8.0-openjdk security update

2021-07-21T07:31:58
rocky
unix

java-11-openjdk security update

2021-07-21T07:28:55
redhat
unix

(RHSA-2021:2569) Moderate: libxml2 security update

2021-06-29T13:42:19
redhat
unix

(RHSA-2021:3666) Important: nodejs:14 security and bug fix update

2021-09-27T06:47:35
redhat
unix

(RHSA-2021:3623) Important: nodejs:12 security and bug fix update

2021-09-21T12:33:58
redhat
unix

(RHSA-2021:2777) Important: OpenJDK 8u302 Windows Builds release and security update

2021-07-22T14:58:24
redhat
unix

(RHSA-2021:2779) Important: OpenJDK 11.0.12 Security Update for Windows Builds

2021-07-22T15:04:04
redhat
unix

(RHSA-2021:2780) Important: OpenJDK 11.0.12 Security Update for Portable Linux Builds

2021-07-22T15:04:07
redhat
unix

(RHSA-2021:2778) Important: OpenJDK 8u302 Security Update for Portable Linux Builds

2021-07-22T14:58:21
redhat
unix

(RHSA-2021:2775) Important: java-1.8.0-openjdk security update

2021-07-21T11:09:33
redhat
unix

(RHSA-2021:2783) Important: java-11-openjdk security update

2021-07-21T07:30:50
redhat
unix

(RHSA-2021:2784) Important: java-11-openjdk security update

2021-07-21T07:30:32
redhat
unix

(RHSA-2021:2774) Important: java-1.8.0-openjdk security update

2021-07-21T11:09:52
redhat
unix

(RHSA-2021:2845) Important: java-1.8.0-openjdk security and bug fix update

2021-07-21T11:11:02
redhat
unix

(RHSA-2021:2776) Important: java-1.8.0-openjdk security update

2021-07-21T07:31:58
redhat
unix

(RHSA-2021:2782) Important: java-11-openjdk security update

2021-07-21T07:31:14
redhat
unix

(RHSA-2021:2781) Important: java-11-openjdk security update

2021-07-21T07:28:55
redhat
unix

(RHSA-2021:3293) Moderate: java-1.7.1-ibm security update

2021-08-30T07:50:49
oraclelinux
unix

libxml2 security update

2021-07-03T00:00:00
oraclelinux
unix

nodejs:14 security and bug fix update

2021-09-27T00:00:00
oraclelinux
unix

nodejs:12 security and bug fix update

2021-09-22T00:00:00
oraclelinux
unix

java-11-openjdk security update

2021-07-22T00:00:00
oraclelinux
unix

java-1.8.0-openjdk security update

2021-07-22T00:00:00
oraclelinux
unix

java-1.8.0-openjdk security and bug fix update

2021-07-22T00:00:00
oraclelinux
unix

java-11-openjdk security update

2021-07-22T00:00:00
amazon
unix

Medium: libxml2

2021-07-01T01:03:00
amazon
unix

Important: java-1.8.0-openjdk

2021-09-02T22:54:00
amazon
unix

Important: java-1.8.0-openjdk

2021-08-04T20:32:00
amazon
unix

Important: java-11-amazon-corretto

2021-07-21T00:43:00
archlinux
unix

[ASA-202107-54] jre11-openjdk-headless: multiple issues

2021-07-21T00:00:00
archlinux
unix

[ASA-202107-65] jre-openjdk-headless: multiple issues

2021-07-22T00:00:00
archlinux
unix

[ASA-202107-53] jdk11-openjdk: multiple issues

2021-07-21T00:00:00
archlinux
unix

[ASA-202107-66] jre-openjdk: multiple issues

2021-07-22T00:00:00
centos
unix

java security update

2021-07-22T13:56:57
centos
unix

java security update

2021-08-11T16:31:46