Security Bulletin: A security vulnerability has been identified in PCRE, which is a required product for IBM Tivoli Network Manager IP Edition (CVE-2020-14155)

Summary

A security vulnerability has been disclosed in the pcre library libpcre, which is installed as part of IBM Tivoli Network Manager version 4.2. Information about this vulnerability has been published in a security bulletin.

Vulnerability Details

CVEID:CVE-2020-14155
**DESCRIPTION:**PCRE could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in libpcre. By sending a request with a large number, an attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183499 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

Please contact support team and refer CVE-2020-14155

ITNM| 4.1.x|

Please contact support team and refer CVE-2020-14155

ITNM| 4.2.0|

Upgrade to ITNM 4.2 Fix Pack 11 (4.2.0.11), as per:

Download IBM Tivoli Network Manager 4.2 Fix Pack 11

Workarounds and Mitigations

None