Security Bulletin: Update Secure Gateway Client in IBM DataPower Gateway to address several CVEs

Summary Update the version of Node used by Secure Gateway Client component to address the listed CVEs. This issue affects only users of the Secure Gateway Client. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer...

IBM DataPower Gateway Code Injection Vulnerability

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates, and optimizes access across channel...

CVE-2020-4992

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737...

CVE-2020-4992

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737...

Cross site request forgery (csrf)

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737...

CVE-2020-4992

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737...

CVE-2020-4992

IBM DataPower Gateway (2018.4.1.0–2018.4.1.16) is documented as vulnerable to cross-site request forgery (CSRF). The issue enables an attacker to perform malicious, unauthorized actions transmitted from a trusted user’s session. Affected versions are fixed in 2018.4.1.17, per IBM’s security bulle...

PT-2021-12271

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.16 Description The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request forgery...

CVE-2020-4992: Cross-Site Request Forgery (CSRF)

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737...

Security Bulletin: IBM DataPower Gateway potentially vulnerable to CSRF attack

Summary IBM has addressed the applicable CVE Vulnerability Details CVEID: CVE-2020-4992 DESCRIPTION: IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. CVSS...

Security Bulletin: IBM DataPower Gateway vulnerable to a DoS

Summary IBM has addressed the aplicable CVE Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could exploit this vulnerability to cause the applicati...

Security Bulletin: Potential DoS in IBM DataPower Gateway

Summary IBM has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signaturealgorithms processing. By sending a specially crafted renegotiation ClientHello message from a clien...

Security Bulletin: Prototype pollution flaw in y18n in IBM DataPower Gateway

Summary IBM has addressed the CVE Vulnerability Details CVEID: CVE-2020-7774 DESCRIPTION: Node.js y18n module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By sending a specially-crafted request, an attacker could exploit this...

Security Bulletin: Vulnerabilities in Node.js in IBM DataPower Gateway

Summary IBM has addressed the following CVEs: CVE-2020-8287, CVE-2020-8265 Vulnerability Details CVEID: CVE-2020-8287 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web...

IBM DataPower Gateway 跨站请求伪造漏洞

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates, and optimizes access across channel...

CVE-2020-4992

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737...

Security Bulletin: IBM DataPower Gateway is potentially vulnerable to a Denial of Service (CVE-2020-14147)

Summary IBM has addressed CVE-2020-14147 Vulnerability Details CVEID: CVE-2020-14147 DESCRIPTION: Redis is vulnerable to a denial of service, caused by an integer overflow in the getnum function in luastruct.c in Redis. By sending a specially crafted command with a large number, a remote attacker...

Security Bulletin: IBM DataPower Gateway affected by vulnerability in OpenSSL (CVE-2019-1551)

Summary IBM DataPower Gateway has addressed a potential overflow in OpenSSL: CVE-2019-1551 Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x6464 Montgomery squaring procedure used in...

Security Bulletin: Denial of Service with HTTP/2 in IBM DataPower Gateway (CVE-2020-4579)

Summary IBM has addressed the relevant CVE CVE-2020-4579 Vulnerability Details CVEID: CVE-2020-4579 DESCRIPTION: IBM DataPower Gateway could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. CVSS Base score: 7.5 CVSS Tempor...

Security Bulletin: Denial of Service with HTTP/2 in IBM DataPower Gateway (CVE-2020-4581)

Summary IBM has addressed the relevant CVE CVE-2020-4581 Vulnerability Details CVEID: CVE-2020-4581 DESCRIPTION: IBM DataPower Gateway could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 request. CVSS Base score: 7.5 CVSS Temporal Score: See:...