Security Bulletin: IBM Event Streams is affected by a vulnerability in Golang Go (CVE-2022-41717)

Summary This security vulnerability affects the memory growth in Go before version 1.18.9 that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-41717 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in the Go server. By...

Security Bulletin: IBM Event Streams is affected by a vulnerability in Express.js Express (CVE-2022-24999)

Summary This security vulnerability affects qs package before 6.10.3 that is used by the IBM Event Streams UI component. Vulnerability Details CVEID:CVE-2022-24999 DESCRIPTION: Express.js Express is vulnerable to a denial of service, caused by a prototype pollution flaw in qs. By adding or...

Security Bulletin: Vulnerability in the Golang language affects IBM Event Streams (CVE-2022-3064)

Summary This security vulnerability affects Golang that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-3064 DESCRIPTION: Go-Yaml package is vulnerable to a denial of service, caused by an unbounded alias chasing flaw. By using a specially-crafted YAML file, a remote attacker...

Security Bulletin: Vulnerabilities in the Java JDK affect IBM Event Streams (CVE-2022-3676, CVE-2022-21628, CVE-2022-21626, CVE-2022-21624, CVE-2022-21619)

Summary There are a number of vulnerabilities in the Java JDK used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a...

Security Bulletin: Vulnerability in GraphQL Java affects IBM Event Streams (CVE-2022-37734)

Summary There is a vulnerability in GraphQL Java that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-37734 DESCRIPTION: GraphQL Java is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw. By sending a specially-crafted request using Directiv...

Security Bulletin: Vulnerability in Golang Go affects IBM Event Streams (CVE-2022-27664)

Summary There is a vulnerability in Golang Go that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-27664 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in net/http. By sending a specially-crafted request, a remote attacker could exploit this...

Moderate: Red Hat Security Advisory: Red Hat Integration Debezium 1.9.7 security update

A security update for Debezium is now available for Red Hat Integration. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Security Bulletin: Vulnerabilities in Golang Go affect IBM Event Streams (CVE-2021-38561 and CVE-2021-43565)

Summary There are vulnerabilities in Golang Go that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2021-38561 DESCRIPTION: Golang Go Text is vulnerable to a denial of service, caused by an improper index calculation that allows an incorrectly formatted language tag to panic Parse. ...

Security Bulletin: Vulnerabilities in Node.js affect IBM Event Streams (CVE-2022-35255 and CVE-2022-35256)

Summary There are vulnerabilities in Node.js that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-35255 DESCRIPTION: Node.js could provide weaker than expected security, caused by the failure to check the return value after calls are made to EntropySource in...

Security Bulletin: Vulnerability in the Apache Kafka affects IBM Event Streams (CVE-2022-34917)

Summary This security vulnerability affects Apache Kafka that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-34917 DESCRIPTION: Apache Kafka is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request, a remote attacker cou...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Event Streams

Summary There are a number of vulnerabilities in Node.js that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-32222 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions. By attempting to read openssl.cnf from /home/iojs/build/ upon startup, an...

Security Bulletin: Multiple vulnerabilities in Golang Go affect IBM Event Streams

Summary There are a number of vulnerabilities in Golang Go that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-29804 DESCRIPTION: Golang Go could allow a local attacker to bypass security restrictions, caused by a flaw in the filepath.Clean function. By sending a...

Security Bulletin: Vulnerabilities in Redis affect IBM Event Streams (CVE-2022-24736, CVE-2022-24735)

Summary There are a number of vulnerabilities in Redis that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-24736 DESCRIPTION: Redis is vulnerable to a denial of service, caused by a NULL pointer dereference. By loading a specially crafted Lua script, a local authenticated...

Security Bulletin: Vulnerability in the Node.js jose module affects IBM Event Streams (CVE-2022-36083)

Summary This security vulnerability affects the Node.js jose module that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-36083 DESCRIPTION: Node.js jose module is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request usin...

Security Bulletin: Vulnerability in the Node.js got module affects IBM Event Streams (CVE-2022-33987)

Summary This security vulnerability affects the Node.js got module that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-33987 DESCRIPTION: Node.js got module could allow a remote attacker to bypass security restrictions, caused by an unspecified. By sending a specially-crafted...

Security Bulletin: Vulnerabilities in the Java JDK affect IBM Event Streams (CVE-2021-35550, CVE-2021-35603)

Summary There are a number of vulnerabilities in the Java JDK used by IBM Event Streams. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting ...

Security Bulletin: Vulnerability in the Node.js follow-redirects component affects IBM Event Streams (CVE-2022-0536)

Summary This security vulnerability affects the follow-redirects component that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-0536 DESCRIPTION: Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused by a leakage of...

Security Bulletin: Vulnerability in the jackson-databind component affects IBM Event Streams

Summary This security vulnerability affects the jackson-databind component that is used by IBM Event Streams. Vulnerability Details IBM X-Force ID: 217968 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by an error when using JDK serialization to serialize and...

Security Bulletin: Vulnerability in OpenSSL affects IBM Event Streams (CVE-2022-0778)

Summary There is a vulnerability in the version of OpenSSL used by IBM Event Streams. Vulnerability Details CVEID: CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the BNmodsqrt function when parsing certificates. By using a specially-crafted certificat...

Security Bulletin: Vulnerabilities in the Open Source Node.js runtime affect IBM Event Streams (CVE-2021-44533, CVE-2022-21824, CVE-2021-44531, CVE-2021-44532)

Summary Node.js is used by Event Streams as the runtime for the UI component. This fix updates the Node.js runtime to 16.15.0. Vulnerability Details CVEID:CVE-2021-44533 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by the incorrect handling of...