Lucene search

IBME298AFAE6C10545EEFE2EDCB1E58ACEB81769C82FC173BB89206A046496B5501

HistorySep 01, 2021 - 11:04 a.m.

Log Analysis Security Bulletin List

2021-09-0111:04:11

www.ibm.com

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

JSON

Question

Is there a list of security bulletins that describe resolved vulnerabilities affecting Log Analysis?

Answer

Log Analysis is made up of several components. The following table contains security bulletins that address the vulnerability of various

components in Log Analysis, listed by release.

Version	CVE No.	Component	Vulnerability Description
1.3.7 IF001	Internal Vulnerability	Log Analysis	CSRFToken is not validated or updated on logout and login
The CSRFToken is not validated or updated on each logout and login by Log Analysis. Token value remains the same for all the logins and active sessions until users close the browser.
1.3.7 IF001	Internal Vulnerability	Log Analysis	Log Analysis Help pages are vulnerable to Clickjacking
X-frame-Option header was implemented for Log Analysis application. However this was not implemented for Log Analysis help pages to prevent Clickjacking.
1.3.7	CVE-2017-1000190	Apache Solr	Security Bulletin: Vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis (CVE-2017-1000190)
1.3.7	CVE-2020-11620
CVE-2020-10969
CVE-2020-14062
CVE-2020-14060
CVE-2020-11112
CVE-2020-10968
CVE-2020-10672
CVE-2020-9548
CVE-2020-9546
CVE-2020-11619
CVE-2020-11111
CVE-2020-14195
CVE-2020-14061
CVE-2020-11113
CVE-2020-9547
CVE-2020-10673
CVE-2019-10202
CVE-2019-17531
CVE-2019-14893
CVE-2020-8840
CVE-2019-10172	Apache Solr	Security Bulletin: Series of vulnerabilities in FasterXML jackson-databind affect Apache Solr shipped with IBM Operations Analytics - Log Analysis
1.3.7	CVE-2019-17558	Apache Solr	Security Bulletin: Vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis (CVE-2019-17558)
1.3.7	CVE-2014-3643	Apache Zookeeper	Security Bulletin: Vulnerability in jersey affect Apache Zookeeper shipped with IBM Operations Analytics - Log Analysis (CVE-2014-3643)
1.3.7	CVE-2015-5237	Apache Solr	Security Bulletin: protobuf Vulnerability in Apache Solr affect IBM Operations Analytics - Log Analysis Analysis (CVE-2015-5237)
1.3.7	CVE-2019-10246
CVE-2019-10247
CVE-2019-10241	Apache Solr	Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect Apache Solr shipped with IBM Operations Analytics - Log Analysis
1.3.7	CVE-2020-1945	Apache Ant	Security Bulletin: Vulnerability in Apache Ant affect IBM Operations Analytics - Log Analysis Analysis (CVE-2020-1945)
1.3.7	CVE-2019-17359	Apache Solr	Security Bulletin: Vulnerability in Bouncy Castle affect Apache Solr shipped IBM Operations Analytics - Log Analysis Analysis (CVE-2019-17359)
1.3.7	CVE-2019-12402	Apache Solr	Security Bulletin: Vulnerability in Apache Commons Compress affect Apache Solr shipped IBM Operations Analytics - Log Analysis Analysis (CVE-2019-12402)
1.3.7	CVE-2018-11766
CVE-2017-15713	Apache Solr	Security Bulletin: Multiple vulnerabilities in Apache Hadoop affect Apache Solr shipped with IBM Operations Analytics - Log Analysis
1.3.7	CVE-2019-0201	Apache Zookeeper	Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Apache Zookeeper vulnerability (CVE-2019-0201)
1.3.7	CVE-2018-11768	Apache Solr	Security Bulletin: Vulnerability in Apache Hadoop affect Apache Solr shipped with IBM Operations Analytics - Log Analysis (CVE-2018-11768)
1.3.7	CVE-2019-12415	Apache Solr	Security Bulletin: Apache Solr, shipped with IBM Operations Analytics - Log Analysis, susceptible to vulnerability in Apache POI (CVE-2019-12415)
1.3.7	CVE-2019-0228	Apache Solr	Security Bulletin: Vulnerability in Apache PDFBox affect Apache Solr shipped with IBM Operations Analytics - Log Analysis (CVE-2019-0228)

1.3.7 | CVE-2018-1000613
CVE-2016-1000342
CVE-2016-1000344
CVE-2016-1000345
CVE-2016-1000339
CVE-2016-1000346
CVE-2016-1000338
CVE-2016-1000343
CVE-2016-1000340
CVE-2016-1000352
CVE-2015-6644
CVE-2016-1000341
CVE-2018-1000180 | Apache Solr |

Security Bulletin: Multiple vulnerabilities in Bouncy Castle affects Apache Solr shipped with IBM Operations Analytics - Log Analysis

1.3.7 | CVE-2018-14718
CVE-2018-14719
CVE-2018-19362
CVE-2018-14721
CVE-2018-11307
CVE-2019-16335
CVE-2018-19361
CVE-2018-14720
CVE-2018-19360
CVE-2019-14540
CVE-2019-14379
CVE-2018-12023
CVE-2019-14439
CVE-2019-12814
CVE-2018-12022
CVE-2018-5968
CVE-2019-12384
CVE-2019-12086 | Apache Solr |

Security Bulletin: Multiple vulnerabilities in FasterXML jackson-databind affect Apache Solr shipped with IBM Operations Analytics - Log Analysis

1.3.7 | Internal Vulnerability | Apache Solr | Vulnerabilities from Apache Commons Fileupload: Apache Solr (Lucene)
The class FileUploadBase in Apache Commons Fileupload before 1.4 has potential resource leak - InputStream not closed on exception.
1.3.7 | Internal Vulnerability | Apache Solr,
Log Analysis | Apache Solr (Lucene) and Unity are vulnerable to Apache commons-codec

1.3.7 | CVE-2013-4002
CVE-2012-0881
CVE-2009-2625 | Apache Solr | Security Bulletin: Apache Solr, shipped with IBM Operations Analytics - Log Analysis, susceptible to multiple vulnerabilities in Apache Xerces2
1.3.7 | CVE-2018-10237 | Apache Solr | Security Bulletin: A vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis Analysis (CVE-2018-10237)
1.3.7 | CVE-2018-1000632 | Apache Solr | Security Bulletin: dom4j Vulnerability in Apache Solr shipped with IBM Operations Analytics - Log Analysis Analysis (CVE-2018-1000632)
1.3.7 | CVE-2018-11761
CVE-2018-17197
CVE-2019-10088
CVE-2019-10094
CVE-2018-11796 | Apache Solr | Security Bulletin: Multiple vulnerabilities in Apache Tika affects Apache Solr shipped with IBM Operations Analytics - Log Analysis

1.3.5 FP003 | CVE-2019-0192 | Apache Solr | Security Bulletin: Potential vulnerability related to Unsafe Deserialization in Apache Solr shipped with IBM Operations Analytics - Log Analysis (CVE-2019-0192)

This table contains a list of vulnerabilities that were resolved by the respective version of the component.

Affected Log Analysis Version	CVE No.	Component	Vulnerability Description
1.3.5FP3 1.3.6 1.3.6FP1	CVE-2020-4590	WebSphere Application Server Liberty	Security Bulletin: Vulnerability in WebSphere Application Server Liberty affect IBM Operations Analytics - Log Analysis (CVE-2020-4590)

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

| CVE-2019-4046 | WebSphere Application Server Liberty | Security Bulletin: Potential denial of service vulnerability in WebSphere Application Server affect IBM Operations Analytics - Log Analysis (CVE-2019-4046)

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5FP1

1.3.5FP2

| CVE-2018-10237 | WebSphere Application Server Liberty | Security Bulletin: Potential denial of service in WebSphere Application Server shipped with IBM Operations Analytics - Log Analysis (CVE-2018-10237)
1.3.5 | CVE-2017-12624 | WebSphere Application Server Liberty | Security Bulletin: Denial of Service in Apache CXF used by WebSphere Application Server affect IBM Operations Analytics - Log Analysis (CVE-2017-12624)

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

| CVE-2018-1447
CVE-2018-1388
CVE-2016-0702
CVE-2016-0705
CVE-2017-3732
CVE-2017-3736
CVE-2018-1428
CVE-2018-1427
CVE-2018-1426 | IBM Tivoli
Monitoring | Security Bulletin: Multiple vulnerabilities affect the GSKit component of IBM Tivoli Monitoring shipped with IBM Operations Analytics - Log Analysis
1.3.5 | CVE-2018-1683 | WebSphere Application Server Liberty | Security Bulletin: Information disclosure in WebSphere Application Server Liberty bundled with IBM Operations Analytics - Log Analysis (CVE-2018-1683)
1.3.5 | CVE-2018-8039 | WebSphere Application Server Liberty | Security Bulletin: Potential MITM attack in Apache CXF used by WebSphere Application Server affects IBM Operations Analytics - Log Analysis (CVE-2018-8039)

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

| CVE-2018-1901 | WebSphere Application Server Liberty | Security Bulletin: Potential Privilege Escalation Vulnerability in WebSphere Application Server shipped with IBM Operations Analytics - Log Analysis (CVE-2018-1901)

1.3.5 | CVE-2018-1553 | WebSphere Application Server Liberty | Security Bulletin: Information disclosure in WebSphere Application Server Liberty affect IBM Operations Analytics - Log Analysis (CVE-2018-1553)

1.3.4

1.3.5

| CVE-2014-7810 | WebSphere Application Server Liberty | Security Bulletin: Vulnerability in Expression Language library used by WebSphere Application Server shipped with IBM Operations Analytics - Log Analysis (CVE-2014-7810)
1.3.5 | CVE-2018-1851 | WebSphere Application Server Liberty | Security Bulletin: Code execution vulnerability with OpenID connect in WebSphere Application Server Liberty affects IBM Operations Analytics - Log Analysis (CVE-2018-1851)

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

| CVE-2018-1755 | WebSphere Application Server Liberty | Security Bulletin: Information disclosure in WebSphere Application Server Liberty affect IBM Operations Analytics - Log Analysis (CVE-2018-1755)

[{“Type”:“MASTER”,“Line of Business”:{“code”:“LOB45”,“label”:“Automation”},“Business Unit”:{“code”:“BU053”,“label”:“Cloud & Data Platform”},“Product”:{“code”:“SSPFMY”,“label”:“IBM Operations Analytics - Log Analysis”},“ARM Category”:[{“code”:“a8m50000000L0qYAAS”,“label”:“Log Analysis”},{“code”:“a8m50000000CcMiAAK”,“label”:“Log Analysis->Framework->Security - Vulnerabilities”}],“ARM Case Number”:“”,“Platform”:[{“code”:“PF025”,“label”:“Platform Independent”}],“Version”:“All Versions”}]