Security Bulletin: IBM Aspera On Demand products are affected by OpenSSL Vulnerability (CVE-2019-1552)

Summary Aspera Faspex on Demand 3.9.6, Aspera Platform On Demand 3.9.6, Aspera Shares on Demand 3.9.6, Aspera Server on Demand 3.9.6, Aspera Application on Demand 3.9.6 have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL could allow ...

Security Bulletin: IBM Aspera On Demand products are affected by OpenSSL Vulnerability (CVE-2018-0739)

Summary IBM Aspera On Demand products have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remote attacker could exploit this...

Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055)

Summary The OpenSSL vulnerabilities CVE-2017-3732 CVE-2016-7055 impact IBM Aspera Connect version 3.7.4 and earlier. The fix is delivered in IBM Aspera Connect 3.8.0. Vulnerability Details CVEID: CVE-2017-3732 DESCRIPTION: There is a carry propagating bug in the x8664 Montgomery squaring procedur...

Security Bulletin: OpenSSL vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera Desktop Client 3.9.1 and earlier (CVE-2019-1559)

Summary The OpenSSL vulnerabilities CVE-2019-1559 impact Aspera High-Speed Transfer Server 3.9.1 and earlier, Aspera Desktop Client 3.9.1 and earlier. The fix is delivered in Aspera High-Speed Transfer Server 3.9.3, Aspera Desktop Client 3.9.3. Vulnerability Details CVEID: CVE-2019-1559...

Security Bulletin: OpenSSL vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera Desktop Client 3.9.1 and earlier (CVE-2018-0734)

Summary The OpenSSL vulnerabilities CVE-2018-0734 impact Aspera High-Speed Transfer Server 3.9.1 and earlier, Aspera Desktop Client 3.9.1 and earlier. The fix is delivered in Aspera High-Speed Transfer Server 3.9.3, Aspera Desktop Client 3.9.3. Vulnerability Details CVEID: CVE-2018-0734...

Security Bulletin: OpenSSL vulnerabilites (CVE-2019-1552) impacting IBM Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop 3.9.1 and earlier

Summary OpenSSL vulnerabilites impacting IBM Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop 3.9.1, Aspera Connect 3.7.4 and earlier CVE-2019-1552. The vulnerabilities are fixed in IBM Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint,...

Security Bulletin: OpenSSL vulnerabilites (CVE-2019-1563, CVE-2019-1547) impacting IBM Aspera High-Speed Transfer Server 3.9.1, Aspera High-Speed Transfer Endpoint, Aspera Desktop Client 3.9.1 and earlier

Summary OpenSSL vulnerabilites CVE-2019-1563, CVE-2019-1547 impacting IBM Aspera High-Speed Transfer Server 3.9.1, Aspera High-Speed Transfer Endpoint 3.9.1, Aspera Desktop Client 3.9.1 and earlier. The fix is delivered in IBM Aspera High-Speed Transfer Server 3.9.6, Aspera High-Speed Transfer...

Security Bulletin: IBM Aspera Shares Web Application is affected by NGINX Vulnerabilities (CVE-2019-13067)

Summary IBM Aspera Shares Web Application has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-13067 DESCRIPTION: njs, used in NGINX, is vulnerable to a denial of service, caused by a buffer over-read in nxtutf8decode in nxt/nxtutf8.c. By persuading a victim to...

Security Bulletin: IBM Aspera Shares is affected by the following NGINX vulnerability (CVE-2019-13617)

Summary IBM Aspera Shares has addressed the following NGINX vulnerability Vulnerability Details CVEID: CVE-2019-13617 DESCRIPTION: njs, used in NGINX, is vulnerable to a denial of service, caused by a heap-based buffer over-read in nxtvsprintf in nxt/nxtsprintf.c during error handling. By...

Security Bulletin: Aspera Web Shares application is affected by NGINX Vulnerabilities (CVE-2019-12208, CVE-2019-12207)

Summary IBM Aspera Shares has addressed the following NGINX vulnerabilities. Vulnerability Details CVEID: CVE-2019-12208 DESCRIPTION: NGINX njs is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the njsfunctionnativecall function in njs/njsfunction.c. By sending...

Security Bulletin: Aspera Web Applications (Faspex, Console, Orchestrator) are affected by OpenSSL Vulnerabilities (CVE-2019-1547, CVE-2019-1549, CVE-2019-1563)

Summary Aspera Web Applications Faspex, Console, Orchestrator have addressed the following OpenSSL Vulnerabilities. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However,...

Security Bulletin: Aspera Web Faspex application is affected by OpenSSL Vulnerability (CVE-2019-1552)

Summary IBM Aspera Faspex has addressed the following OpenSSL vulnerability Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is mos...

Security Bulletin: Aspera Web Application (Faspex, Console, Orchestrator, Shares) are affected by Apache vulnerabilities (CVE-2019-9517, CVE-2019-10097)

Summary Aspera Web Application Faspex, Console, Shares, Orchestrator have affected the following Apache vulnerabilities. Vulnerability Details CVEID: CVE-2019-9517 DESCRIPTION: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of...

Security Bulletin: Aspera Web Applications (Faspex, Console) are affected by Apache Vulnerabilities (CVE-2019-0196, CVE-2019-0197, CVE-2019-0215, CVE-2019-0217, CVE-2019-0220)

Summary Aspera Web Applications Faspex, Console have addressed the following Apache Vulnerabilities. Vulnerability Details CVEID: CVE-2019-0220 DESCRIPTION: A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive...

Security Bulletin: IBM Aspera WebApps (Shares, Faspex, Console, Orchestrator) and products are affected by OpenSSL Vulnerability (CVE-ID: CVE-2019-1543)

Summary IBM Aspera WebApps Shares, Faspex, Console, Orchestrator products have addressed the following OpenSSL vulnerability Vulnerability Details CVEID: CVE-2019-1543 DESCRIPTION: ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539...

Security Bulletin: Aspera Web Applications (Faspex, Console, Shares) are affected by Apache Vulnerabilities (CVE-2019-10081, CVE-2019-10082, CVE-2019-10092, CVE-2019-10098), )

Summary Aspera Web Applications Faspex, Console, Shares have addressed the following Apache vulnerabilities. Vulnerability Details CVEID: CVE-2019-10081 DESCRIPTION: HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory ...

Security Bulletin: Aspera Web Shares application is affected by NGINX Vulnerabilities (CVE-2018-16845, CVE-2018-16843, CVE-2019-7401)

Summary IBM Aspera Shares has addressed the following OpenSSL vulnerabilities. Vulnerability Details CVEID: CVE-2019-7401 DESCRIPTION: NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request. This may result in a...

Security Bulletin: Aspera Shares application is affected by multiple NGINX Vulnerabilities (CVE-2019-12206, CVE-2019-12207, CVE-2019-12208, CVE-2019-13617, CVE-2018-16845, CVE-2018-16843, CVE-2019-7401)

Summary IBM Aspera Shares has addressed the following NGINX vulnerabilities. Vulnerability Details CVEID: CVE-2019-7401 DESCRIPTION: NGINX Unit is vulnerable to a denial of service, caused by a heap-based buffer overflow in the router process. By sending a specially-crafted request, a remote...

Security Bulletin: Aspera Web Applications (Faspex, Orchestrator, Shares) and On Demand products are affected by OpenSSL Vulnerabilities (CVE-2018-5407)

Summary Aspera Web Applications Faspex, Orchestrator, Shares and On Demand products have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2018-5407 DESCRIPTION: Multiple SMT/Hyper-Threading architectures and processors could allow a local attacker to obtain sensitiv...

Security Bulletin: Aspera Web Applications (Faspex, Console) and On Demand products are affected by OpenSSL Vulnerability (CVE-2017-7468)

Summary Aspera Web Applications Faspex, Console and On Demand products have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID:CVE-2017-7468 DESCRIPTION: No CVE description. CVSS Base Score: 3.1 CVSS Temporal Score: See Not Applicable for the current score CVSS Environment...