CVE-2020-4433

Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force I...

CVE-2020-4434

Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service DoS through the http fallback service. IBM...

CVE-2020-4433

CVE-2020-4433 concerns IBM Aspera applications vulnerable to a stack-based buffer overflow caused by improper bounds checking. The vulnerability could allow a remote attacker with knowledge of the system to execute arbitrary code with root privileges or cause the server to crash. The IBM security...

CVE-2020-4432

Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810...

CVE-2020-4432

CVE-2020-4432 affects IBM Aspera applications vulnerable to command injection after valid authentication via the SOAP API. Affected products include IBM Aspera High-Speed Transfer Server/Endpoint, Aspera Proxy Server, Transfer Cluster Manager, and related platforms per IBM advisory. The root issu...

Security Bulletin: IBM Aspera On Demand products are affected by OpenSSL Vulnerability (CVE-2019-1552)

Summary Aspera Faspex on Demand 3.9.6, Aspera Platform On Demand 3.9.6, Aspera Shares on Demand 3.9.6, Aspera Server on Demand 3.9.6, Aspera Application on Demand 3.9.6 have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL could allow ...

Security Bulletin: IBM Aspera On Demand products are affected by OpenSSL Vulnerability (CVE-2018-0739)

Summary IBM Aspera On Demand products have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remote attacker could exploit this...

Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055)

Summary The OpenSSL vulnerabilities CVE-2017-3732 CVE-2016-7055 impact IBM Aspera Connect version 3.7.4 and earlier. The fix is delivered in IBM Aspera Connect 3.8.0. Vulnerability Details CVEID: CVE-2017-3732 DESCRIPTION: There is a carry propagating bug in the x8664 Montgomery squaring procedur...

Security Bulletin: OpenSSL vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera Desktop Client 3.9.1 and earlier (CVE-2019-1559)

Summary The OpenSSL vulnerabilities CVE-2019-1559 impact Aspera High-Speed Transfer Server 3.9.1 and earlier, Aspera Desktop Client 3.9.1 and earlier. The fix is delivered in Aspera High-Speed Transfer Server 3.9.3, Aspera Desktop Client 3.9.3. Vulnerability Details CVEID: CVE-2019-1559...

Security Bulletin: OpenSSL vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera Desktop Client 3.9.1 and earlier (CVE-2018-0734)

Summary The OpenSSL vulnerabilities CVE-2018-0734 impact Aspera High-Speed Transfer Server 3.9.1 and earlier, Aspera Desktop Client 3.9.1 and earlier. The fix is delivered in Aspera High-Speed Transfer Server 3.9.3, Aspera Desktop Client 3.9.3. Vulnerability Details CVEID: CVE-2018-0734...

Security Bulletin: OpenSSL vulnerabilites (CVE-2019-1552) impacting IBM Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop 3.9.1 and earlier

Summary OpenSSL vulnerabilites impacting IBM Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop 3.9.1, Aspera Connect 3.7.4 and earlier CVE-2019-1552. The vulnerabilities are fixed in IBM Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint,...

Security Bulletin: OpenSSL vulnerabilites (CVE-2019-1563, CVE-2019-1547) impacting IBM Aspera High-Speed Transfer Server 3.9.1, Aspera High-Speed Transfer Endpoint, Aspera Desktop Client 3.9.1 and earlier

Summary OpenSSL vulnerabilites CVE-2019-1563, CVE-2019-1547 impacting IBM Aspera High-Speed Transfer Server 3.9.1, Aspera High-Speed Transfer Endpoint 3.9.1, Aspera Desktop Client 3.9.1 and earlier. The fix is delivered in IBM Aspera High-Speed Transfer Server 3.9.6, Aspera High-Speed Transfer...

Security Bulletin: IBM Aspera Shares Web Application is affected by NGINX Vulnerabilities (CVE-2019-13067)

Summary IBM Aspera Shares Web Application has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-13067 DESCRIPTION: njs, used in NGINX, is vulnerable to a denial of service, caused by a buffer over-read in nxtutf8decode in nxt/nxtutf8.c. By persuading a victim to...

Security Bulletin: IBM Aspera Shares is affected by the following NGINX vulnerability (CVE-2019-13617)

Summary IBM Aspera Shares has addressed the following NGINX vulnerability Vulnerability Details CVEID: CVE-2019-13617 DESCRIPTION: njs, used in NGINX, is vulnerable to a denial of service, caused by a heap-based buffer over-read in nxtvsprintf in nxt/nxtsprintf.c during error handling. By...

Security Bulletin: Aspera Web Shares application is affected by NGINX Vulnerabilities (CVE-2019-12208, CVE-2019-12207)

Summary IBM Aspera Shares has addressed the following NGINX vulnerabilities. Vulnerability Details CVEID: CVE-2019-12208 DESCRIPTION: NGINX njs is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the njsfunctionnativecall function in njs/njsfunction.c. By sending...

Security Bulletin: Aspera Web Applications (Faspex, Console, Orchestrator) are affected by OpenSSL Vulnerabilities (CVE-2019-1547, CVE-2019-1549, CVE-2019-1563)

Summary Aspera Web Applications Faspex, Console, Orchestrator have addressed the following OpenSSL Vulnerabilities. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However,...

Security Bulletin: Aspera Web Faspex application is affected by OpenSSL Vulnerability (CVE-2019-1552)

Summary IBM Aspera Faspex has addressed the following OpenSSL vulnerability Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is mos...

Security Bulletin: Aspera Web Application (Faspex, Console, Orchestrator, Shares) are affected by Apache vulnerabilities (CVE-2019-9517, CVE-2019-10097)

Summary Aspera Web Application Faspex, Console, Shares, Orchestrator have affected the following Apache vulnerabilities. Vulnerability Details CVEID: CVE-2019-9517 DESCRIPTION: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of...

Security Bulletin: Aspera Web Applications (Faspex, Console) are affected by Apache Vulnerabilities (CVE-2019-0196, CVE-2019-0197, CVE-2019-0215, CVE-2019-0217, CVE-2019-0220)

Summary Aspera Web Applications Faspex, Console have addressed the following Apache Vulnerabilities. Vulnerability Details CVEID: CVE-2019-0220 DESCRIPTION: A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive...

Security Bulletin: IBM Aspera WebApps (Shares, Faspex, Console, Orchestrator) and products are affected by OpenSSL Vulnerability (CVE-ID: CVE-2019-1543)

Summary IBM Aspera WebApps Shares, Faspex, Console, Orchestrator products have addressed the following OpenSSL vulnerability Vulnerability Details CVEID: CVE-2019-1543 DESCRIPTION: ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539...