227 matches found
Security Bulletin: IBM Event Streams is affected by potential data integrity issue (CVE-2020-25649)
Summary IBM Event Streams is potentially vulnerable to a data integrity issue Vulnerability Details CVEID: CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly. A remote attacker could exploit th...
Security Bulletin: Event Streams documentation for generating .p12 files incorrectly adds the CA key into the file (CVE-2021-29792)
Summary Event Streams documentation for generating .p12 files incorrectly adds the CA private key into the file which results in the CA private key being added to the trust store. This trust store is distributed to client applications via the Event Streams UI and CLI and so gives client access to...
CVE-2021-29792
IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain privileges of another user. IBM X-Force ID: 203450...
CVE-2021-29792
IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain privileges of another user. IBM X-Force ID: 203450...
Code injection
IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain privileges of another user. IBM X-Force ID: 203450...
CVE-2021-29792
IBM Event Streams 10.0.x–10.3.x are affected by CVE-2021-29792. The issue arises when generating PKCS12 truststores: the CA private key can be included in the truststore, which is distributed to clients via the UI/CLI, enabling a user to create their own certificates and deploy them in the cluste...
CVE-2021-29792
IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain privileges of another user. IBM X-Force ID: 203450...
IBM Event Streams 安全漏洞
IBM Event Streams is a set of event streaming platform based on Apache Kafka project from IBM, USA. The platform is primarily used for Apache Kafka deployment, authentication and encrypted communication functions. A security vulnerability exists in IBM Event Streams that allows users to create...
Security Bulletin: IBM Event Streams affected by multiple Java SE security vulnerabilities
Summary IBM Event Streams is affected by multiple Java SE vulnerabilities. All Java components have been updated to deploy on the latest IBM SDK Vulnerability Details CVEID: CVE-2020-14792 DESCRIPTION: An unspecified vulnerability in Java SE related to the Hotspot component could allow an...
Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities
Summary IBM Event Streams is affected by the following vulnerabilities in the included Node.js runtime that is used for the UI and Schema Registry Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS reco...
Security Bulletin: IBM Event Streams is affected by multiple Go vulnerabilities
Summary IBM Event Streams is affected by the following vulnerabilities in the Golang Go runtime that is used in some of containers in the Event Streams deployment and for the Event Streams CLI Vulnerability Details CVEID: CVE-2020-28362 DESCRIPTION: Golang Go is vulnerable to a denial of service,...
Security Bulletin: IBM Event Streams is affected by GNU gettext vulnerability CVE-2018-18751
Summary IBM Event Streams has addressed the following vulnerability Vulnerability Details CVEID: CVE-2018-18751 DESCRIPTION: GNU gettext is vulnerable to a denial of service, caused by a double free flaw in the defaultaddmessage function in read-catalog.c. By persuading a victim to open a...
Security Bulletin: A vulnerability exists in the Event Streams 10.0.0 schema registry that allows unauthorised access to create, edit and delete schemas (CVE-2020-4662)
Summary A vulnerability exists in the Event Streams 10.0.0 schema registry that allows unauthorised access to create, edit and delete schemas Vulnerability Details CVEID: CVE-2020-4662 DESCRIPTION: IBM Event Streams could allow an authenticated user to perform tasks to a schema due to improper...
Security Bulletin: IBM Event Streams is affected by a Node.js http-proxy and lodash module vulnerabilities
Summary IBM Event Streams is affected by a Node.js http-proxy and lodash module denial of service vulnerabilities Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...
Security Bulletin: IBM Event Streams is affected by a Redis vulnerability (CVE-2020-14147)
Summary IBM Event Streams is affected by a Redis vulnerability utlised by the UI component Vulnerability Details CVEID: CVE-2020-14147 DESCRIPTION: Redis is vulnerable to a denial of service, caused by an integer overflow in the getnum function in luastruct.c in Redis. By sending a specially...
Security Bulletin: IBM Event Streams is affected by a vulnerability in the Go runtime (CVE-2020-16845)
Summary IBM Event Streams is affected by a vulnerability in the Go runtime Vulnerability Details CVEID: CVE-2020-16845 DESCRIPTION: Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. By sending a specially-crafted...
IBM Event Streams Authorization Issues Vulnerability
IBM Event Streams is a set of event streaming platform based on Apache Kafka project from IBM, USA. The platform is mainly used for Apache Kafka deployment, authentication and encrypted communication and other functions. An authorization issue vulnerability exists in the schema registry in IBM...
CVE-2020-4662
IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233...