Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Node.js

Summary IBM has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2019-15606 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have trailing OWS trimmed. By sending a specially-crafted request, an...

Security Bulletin: IBM DataPower Gateway may allow a potential DoS when importing malicious ZIP files (CVE-2019-13232)

Summary IBM has addressed CVE-2019-13232 Vulnerability Details CVEID: CVE-2019-13232 DESCRIPTION: Info-ZIP UnZip is vulnerable to a denial of service, caused by mishandling the overlapping of files inside a ZIP container. By persuading a victim to open a specially crafted file, a remote attacker...

Security Bulletin: IBM DataPower Gateway is potentially vulnerable to a Denial of Service (CVE-2020-14147)

Summary IBM has addressed CVE-2020-14147 Vulnerability Details CVEID: CVE-2020-14147 DESCRIPTION: Redis is vulnerable to a denial of service, caused by an integer overflow in the getnum function in luastruct.c in Redis. By sending a specially crafted command with a large number, a remote attacker...

Security Bulletin: IBM DataPower Gateway affected by multiple vulnerabilities in Dojo

Summary IBM has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this vulnerability to...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Node.js

Summary IBM has addressed the following CVEs: CVE-2019-15605, CVE-2019-15606 Vulnerability Details CVEID: CVE-2019-15605 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an...

Security Bulletin: Denial of Service with HTTP/2 in IBM DataPower Gateway (CVE-2020-4581)

Summary IBM has addressed the relevant CVE CVE-2020-4581 Vulnerability Details CVEID: CVE-2020-4581 DESCRIPTION: IBM DataPower Gateway could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 request. CVSS Base score: 7.5 CVSS Temporal Score: See:...

Security Bulletin: IBM DataPower Gateway affected by XSS vulnerability (CVE-2019-10785)

Summary IBM has addressed the CVE Vulnerability Details CVEID: CVE-2019-10785 DESCRIPTION: Dojox is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the dojox.xmpp.util.xmlEncode. A remote attacker could exploit this vulnerability to execute script in a...

Security Bulletin: IBM DataPower Gateway affected by multiple vulnerabilities in Java Runtime

Summary IBM has addressed the following CVEs: CVE-2020-2593, CVE-2020-2583 Vulnerability Details CVEID: CVE-2020-2593 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Networking component could allow an unauthenticated attacker to cause low confidentiality impact, low...

Security Bulletin: IBM DataPower Gateway has released a fixpack in response to the vulnerability known as Spectre.

Summary IBM has released the following fixpack for IBM DataPower Gateways in response to CVE-2017-5753. Vulnerability Details CVEID: CVE-2017-5753 Affected Products and Versions IBM DataPower Gateways appliances, versions 7.1.0.0-7.1.0.21, 7.2.0.0-7.2.0.18, 7.5.0.0-7.5.0.12, 7.5.1.0-7.5.1.11,...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. IBM DataPower Gateway has addressed the corresponding applicable CVEs. Vulnerability Details CVEID: CVE-2015-0287 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Potential exposure of sensitive data in IBM DataPower Gateway (CVE-2020-4203)

Summary IBM DataPower Gateway could permit privileged users to view certain internal directories. IBM has addressed the CVE. Vulnerability Details CVEID: CVE-2020-4203 DESCRIPTION: IBM DataPower Gateway could potentially disclose highly sensitive information to a privileged user due to improper...

Security Bulletin: Potential side-channel cryptographic vulnerabilities in IBM DataPower Gateway

Summary IBM DataPower Gateway is potentially vulnerable to two side-channel attacks CVE-2018-0495, CVE-2018-12404 Vulnerability Details CVEID: CVE-2018-0495 DESCRIPTION: Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be...

Security Bulletin: Certificates not removed from DataPower ValCred when updating corresponding APIc truststore (CVE-2020-4205)

Summary When a certificate is removed from an APIc TrustStore, the correspsonding DataPower ValCred may not be updated to match. Vulnerability Details CVEID: CVE-2020-4205 DESCRIPTION: IBM DataPower Gateway could allow an authenticated user to bypass security restrictions, and continue to access...

Security Bulletin: Potential TLS vulnerability using Diffie-Hellman TLS ciphersuites in IBM DataPower Gateway (CVE-2020-1968)

Summary IBM has addressed the relevant CVE CVE-2020-1968 Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections which have...

Security Bulletin: IBM DataPower Monitor is potentially vulnerable to an authentication bypass (CVE-2020-8172)

Summary IBM has addressed the relevant CVE CVE-2020-8172 Vulnerability Details CVEID: CVE-2020-8172 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions. The 'session' event could be emitted before the 'secureConnect' event and possibly allow for the reuse of the TLS...

Security Bulletin: Denial of Service in IBM DataPower Gateway (CVE-2020-4580)

Summary IBM has addressed the relevant CVE CVE-2020-4580 Vulnerability Details CVEID: CVE-2020-4580 DESCRIPTION: IBM DataPower Gateway could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. CVSS Base score: 7.5 CVSS Tempor...

Security Bulletin: IBM DataPower Gateway is potentially vulnerable to a DoS issue when processing regular expressions (CVE-2017-16231)

Summary IBM has addressed the following CVE: CVE-2017-16231 Vulnerability Details CVEID: CVE-2017-16231 DESCRIPTION: PCRE is vulnerable to a denial of service, caused by a buffer overflow in the match function in pcreexec.c. By persuading a victim to open a specially crafted file, a remote attack...

Security Bulletin: IBM DataPower Gateway can expose remote credentials to local users (CVE-2020-4528)

Summary Passwords provided as part of a URL for an administrative COPY command may appear in the administrative log. If the password is not provided in the URL, it will be prompted for, and will not appear in the log. Vulnerability Details CVEID: CVE-2020-4528 DESCRIPTION: IBM MQ Appliance could...

Security Bulletin: Vulnerabities in SSL in IBM DataPower Gateway

Summary IBM DataPower Gateway has addressed two CVEs relating to SSL: CVE-2019-1559 & CVE-2018-0734 Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, and once to receive one then...

Security Bulletin: IBM DataPower Gateway vulnerability in TLS (CVE-2020-4831)

Summary IBM has addressed CVE-2020-4831 Vulnerability Details CVEID: CVE-2020-4831 DESCRIPTION: IBM DataPower Gateway uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score: 5.9 CVSS Temporal Score: See:...