Security Bulletin: IBM Operations Analytics – Log Analysis is affected by a security feature bypass due to Azure SDK for Java

Summary Azure SDK for Java is used by IBM Operations Analytics – Log Analysis as part of secure, asynchronous messaging and event streaming over AMQP Advanced Message Queuing Protocol. CVE‑2020‑16971. Vulnerability Details CVEID:CVE-2020-16971 DESCRIPTION: Azure SDK for Java Security Feature Bypa...

Security Bulletin: IBM QRadar SIEM protocol is affected by an Elevation of Privilege in the Azure SDK for Java.

Summary Azure SDK for Java may allow privilege escalation under certain conditions; IBM QRadar SIEM has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2020-16971 DESCRIPTION: Azure SDK for Java Security Feature Bypass Vulnerability CVSS Source: NVD CVSS Base score: 9.1 CVSS...

com.microsoft.azure:azure-eventhubs-eph (0.7.7) potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.7.7)

com.microsoft.azure:azure-eventhubs MAVEN version 0.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 0.7.7 Source cves: CVE-2020-16971 Source advisory...

com.microsoft.azure:azure-eventhubs-eph (0.14.2), io.zipkin.azure:zipkin-autoconfigure-collector-eventhub (0.1.8) +3 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.14.2)

com.microsoft.azure:azure-eventhubs MAVEN version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 0.14.2 -...

com.microsoft.azure:spark-streaming-eventhubs_2.11 (>=2.0.8, <=2.1.4), com.microsoft.azure:spark-streaming-eventhubs_connector_2.11 (>=2.0.8, <=2.1.4) +1 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.14.3)

com.microsoft.azure:azure-eventhubs MAVEN version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:spark-streaming-eventhubs2.11 =2.0.8, =2.0.8, =2.0.8, =2.1.4 Source...

com.microsoft.azure:azure-eventhubs-eph (0.14.4), io.zipkin.azure:zipkin-autoconfigure-collector-eventhub (>=0.1.9, <=0.7.2) +3 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.14.4)

com.microsoft.azure:azure-eventhubs MAVEN version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 0.14.4 -...

org.apache.samza:samza-azure (0.14.0), org.apache.samza:samza-tools (0.14.0) potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.14.5)

com.microsoft.azure:azure-eventhubs MAVEN version 0.14.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - org.apache.samza:samza-azure 0.14.0 - org.apache.samza:samza-tools 0.14.0 Source cves:...

com.microsoft.azure:azure-eventhubs-eph (1.0.0), com.microsoft.azure:azure-eventhubs-spark_2.11 (>=2.2.0-preview, <=2.3.0-preview) +3 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (1.0.0)

com.microsoft.azure:azure-eventhubs MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 1.0.0 -...

com.microsoft.azure:azure-eventhubs-spark_2.11 (>=2.2.3, <=2.3.4) potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (1.1.0)

com.microsoft.azure:azure-eventhubs MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-spark2.11 =2.2.3, =2.3.4 Source cves: CVE-2020-16971...

ai.tripl:arc-jupyter_2.11 (>=0.0.13, <=0.0.14), ai.tripl:arc_2.11 (>=1.13.3, <=1.15.0) +1 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (1.2.0)

com.microsoft.azure:azure-eventhubs MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - ai.tripl:arc-jupyter2.11 =0.0.13, =1.13.3, =2.2.5, =2.3.5 Source cves: CVE-2020-16971...

com.microsoft.azure:azure-eventhubs-eph (2.5.0), com.microsoft.azure:azure-eventhubs-spark_2.11 (>=2.2.10, <=2.3.10) +2 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (2.3.0)

com.microsoft.azure:azure-eventhubs MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 2.5.0 -...

com.microsoft.azure:azure-eventhubs-eph (2.5.2), com.microsoft.azure:azure-eventhubs-spark_2.11 (>=2.3.12, <=2.3.14-beta-6) +7 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (2.3.2)

com.microsoft.azure:azure-eventhubs MAVEN version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 2.5.2 -...

com.hurence.logisland:logisland-engine-spark_2_common (>=1.4.0, <=1.4.1), com.linkedin.feathr:feathr_2.12 (>=0.1.0, <=0.1.1) +9 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (>=3.0.0, <=3.2.0)

com.microsoft.azure:azure-eventhubs MAVEN version =3.0.0, =1.4.0, =0.1.0, =3.0.0, =3.0.0, =2.3.14, =2.3.15, =1.12.0, =1.12.0, =1.4.0, =1.4.0, =1.4.1 Source cves: CVE-2020-16971 Source advisory: OSV:GHSA-8Q69-PW39-HPQH...

com.hurence.logisland:logisland-engine-spark_2_common (>=1.4.0, <=1.4.1), com.linkedin.feathr:feathr_2.12 (>=0.1.0, <=0.1.1) +9 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (>=3.0.0, <=3.2.0)

com.microsoft.azure:azure-eventhubs MAVEN version =3.0.0, =1.4.0, =0.1.0, =3.0.0, =3.0.0, =2.3.14, =2.3.15, =1.12.0, =1.12.0, =1.4.0, =1.4.0, =1.4.1 Source cves: CVE-2020-16971 Source advisory: GHSA-8Q69-PW39-HPQH...

com.microsoft.azure:azure-eventhubs-eph (2.1.0) potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (1.3.0)

com.microsoft.azure:azure-eventhubs MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 2.1.0 Source cves: CVE-2020-16971 Source advisory...

com.microsoft.azure:azure-eventhubs-eph (0.10.0), io.zipkin.azure:zipkin-autoconfigure-collector-eventhub (>=0.1.0, <=0.1.3) +1 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.10.0)

com.microsoft.azure:azure-eventhubs MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 0.10.0 -...

com.microsoft.azure:azure-eventhubs-eph (2.2.0), io.github.tilumi:azure-eventhubs-spark-parent_2.11 (2.2.8) +1 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (2.0.0)

com.microsoft.azure:azure-eventhubs MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 2.2.0 -...

com.microsoft.azure:azure-eventhubs-eph (0.8.0) potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.8.0)

com.microsoft.azure:azure-eventhubs MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.microsoft.azure:azure-eventhubs-eph 0.8.0 Source cves: CVE-2020-16971 Source advisory...

com.erudika:para-server (1.20.0) potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.7.5)

com.microsoft.azure:azure-eventhubs MAVEN version 0.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.erudika:para-server 1.20.0 Source cves: CVE-2020-16971 Source advisory:...

com.erudika:para-server (>=1.24.0, <=1.28.4), com.erudika:para-war (>=1.24.4, <=1.28.4) +1 more potentially affected by CVE-2020-16971 via com.microsoft.azure:azure-eventhubs (0.11.0)

com.microsoft.azure:azure-eventhubs MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.azure:azure-eventhubs and may be impacted: - com.erudika:para-server =1.24.0, =1.24.4, =1.28.4 -...