Security Bulletin: IBM App Connect Enterprise Toolkit & IBM Integration Bus Toolkit are vulnerable to a remote attacker due to Apache Derby. (CVE-2022-46337)

Summary IBM App Connect Enterprise Toolkit & IBM Integration Bus Toolkit are vulnerable to a remote attacker due to Apache Derby, which affects the Derby Sample Database in the toolkit. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an information disclosure and a denial of service. (CVE-2024-22317)

Summary The remote administration API in IBM App Connect Enterprise is vulnerable to an information disclosure and denial of service vulnerability due to improper Brute Force protection. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise Toolkit and IBM Integration Bus Toolkit are vulnerable to a remote attacker due to Eclipse JGit (CVE-2023-4759)

Summary Windows users of the Eclipse eGit feature in IBM App Connect Enterprise Toolkit and IBM Integration Bus Toolkit are vulnerable to a remote attacker. Vulnerability Details CVEID:CVE-2023-4759 DESCRIPTION: Eclipse JGit could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Vulnerability in Apache Tomcat affects App Connect Professional.

Summary App Connect Professional has addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID:CVE-2023-45648 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of HTTP trailer headers. By sending a specially crafted...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects App Connect Professional.

Summary There are multiple vulnerabilities in the IBM SDK Java Technology used by App Connect Professional. These issue were disclosed as part of the IBM Java SDK updates in July 2023, App Connect Professional has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-22045...

Security Bulletin: Vulnerability in Apache Tomcat affects App Connect Professional.

Summary App Connect Professional has addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID:CVE-2023-41080 DESCRIPTION: Apache Tomcat could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the FORM...

Security Bulletin: Vulnerability in Apache Tomcat affects App Connect Professional.

Summary App Connect Professional has addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID:CVE-2023-42794 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by accumulation of temporary files on Windows when a web application opened a...

Security Bulletin: Vulnerability in Apache ActiveMQ affects App Connect Professional.

Summary App Connect Professional has addressed the following vulnerability reported in Apache ActiveMQ. Vulnerability Details CVEID:CVE-2023-46604 DESCRIPTION: Apache ActiveMQ and ActiveMQ Legacy OpenWire Module could allow a remote attacker to execute arbitrary code on the system, caused by an...

Security Bulletin: Vulnerability in Apache Tomcat affects App Connect Professional.

Summary App Connect Professional has addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID:CVE-2023-42795 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an incomplete Cleanup vulnerability when recycling...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use the MQ clients and CCDT files are vulnerable to denial of service due to [CVE-2023-38039]

Summary Libcurl is used by the MQ Client code in IBM App Connect Enterprise Certified Container for downloading CCDT information. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use the MQ clients and CCDT files are vulnerable to denial of...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to security restrictions bypass due to [CVE-2023-38552], [CVE-2023-39333]

Summary The Node.js runtime is used by IBM App Connect Enterprise Certified Container in all operands. IBM App Connect Enterprise Certified Container operands are vulnerable to security restrictions bypass. This bulletin provides patch information to address the reported vulnerability in Node.js...

Security Bulletin: IBM App Connect Enterprise Certified Container Dashboard operands that use S3 storage are vulnerable to security restrictions bypass due to [CVE-2023-46234]

Summary Node.js module browserify-sign is used by IBM App Connect Enterprise Certified Container Dashboards for accessing S3 storage. IBM App Connect Enterprise Certified Container Dashboard operands that access bar files in S3 storage are vulnerable to security restrictions bypass. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to regular expression denial of service due to [CVE-2022-25883]

Summary Node.js semver is used by the Node.js runtime in IBM App Connect Enterprise Certified Container operants. IBM App Connect Enterprise Certified Container operands are vulnerable to regular expression denial of service. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL. (CVE-2023-3446)

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL. CVE-2023-3446 Vulnerability Details CVEID:CVE-2023-3446 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using the DHcheck, DHcheckex or EVPPKEYparamcheck functions to check a D...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl. (CVE-2023-38039)

Summary The OpenTelemetry tracing in IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl. CVE-2023-38039 Vulnerability Details CVEID:CVE-2023-38039 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by not limiting the number and size of headers...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to denial of service due to [CVE-2022-41723]

Summary Golang Go is used by IBM App Connect Enterprise Certified Container in the operator catalog, the operator and its operands. The IBM App Connect Enterprise Certified Container operator and the IntegrationServer & IntegrationRuntime operands are vulnerable to denial of service. This bulleti...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL.

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL. CVE-2023-3817 Vulnerability Details CVEID: CVE-2023-3817 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using the DHcheck, DHcheckex or EVPPKEYparamcheck functions to check a ...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to snappy-java CVE-2023-43642)

Summary snappy-java is used by the IBM App Connect Enterprise and IBM Integration Bus Kafka nodes CVE-2023-43642 Vulnerability Details CVEID: CVE-2023-43642 DESCRIPTION: snappy-java is vulnerable to a denial of service, caused by missing upper bound check on chunk length. By sending a specially...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to HTTP header injection due to [CVE-2023-29406]

Summary Golang Go is used by IBM App Connect Enterprise Certified Container in the operator catalog, the operator and its operands. The IBM App Connect Enterprise Certified Container operator and the IntegrationServer & IntegrationRuntime operands are vulnerable to HTTP header injection leading t...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to denial of service due to [CVE-2023-29409]

Summary Golang Go is used by IBM App Connect Enterprise Certified Container in the operator catalog, the operator and its operands. The IBM App Connect Enterprise Certified Container operator and the IntegrationServer & IntegrationRuntime operands are vulnerable to denial of service. This bulleti...