Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities

Summary IBM Event Streams is affected by multiple Node.js vulnerabilities found in the Node.js packages Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...

Security Bulletin: IBM Event Streams is affected by a Java vulnerability (CVE-2020-2654)

Summary IBM Event Streams is affected by a Java vulnerability that was shipped in the Java runtime Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial o...

Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities

Summary IBM Event Streams is affected by the following vulnerabilities in the included Node.js runtime shipped. Vulnerability Details CVEID: CVE-2019-10795 DESCRIPTION: Node.js undefsafe module could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a...

Security Bulletin: IBM Event Streams is affected by WebSphere Liberty Profile vulnerability CVE-2019-4305

Summary IBM Event Streams has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4305 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951...

Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities

Summary IBM Event Streams is affected by the following vulnerabilities in the included Node.js runtime shipped. Vulnerability Details CVEID: CVE-2019-15606 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have...

Security Bulletin: IBM Event Streams is affected by WebSphere Liberty Profile vulnerability CVE-2019-4441

Summary IBM Event Streams has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4441 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser...

Security Bulletin: IBM Event Streams is affected by Apache CXF vulnerability CVE-2019-12406

Summary IBM Event Streams has addressed the following vulnerability Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the failure to restrict the number of message attachments present in a given message. By sending a...

Security Bulletin: IBM Event Streams is affected by Go vulnerability CVE-2019-16276

Summary IBM Event Streams has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-16276 DESCRIPTION: Golang could allow a remote attacker to bypass security restrictions, caused by improper validation of HTTP header. By sending a specially-crafted request, an attacker cou...

Security Bulletin: IBM Event Streams is affected by jackson-databind vulnerability CVE-2020-8840

Summary IBM Event Streams has addressed the following vulnerability Vulnerability Details CVEID: CVE-2020-8840 DESCRIPTION: An unspecified error with the lack of certain xbean-reflect/JNDI blocking in FasterXML jackson-databind has an unknown impact and attack vector. CVSS Base score: 5.3 CVSS...

Security Bulletin: IBM Event Streams is affected by jackson-databind vulnerability CVE-2019-20330

Summary IBM Event Streams has addressed the following vulnerability Vulnerability Details CVEID: CVE-2019-20330 DESCRIPTION: A lacking of certain net.sf.ehcache blocking in FasterXML jackson-databind has an unknown impact and attack vector. CVSS Base score: 7.3 CVSS Temporal Score: See:...

Security Bulletin: IBM Event Streams is affected by WebSphere Liberty Profile vulnerability CVE-2019-4720

Summary IBM Event Streams has addressed the following vulnerability Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit...

Security Bulletin: IBM Event Streams is affected by kafka vulnerability CVE-2019-12399

Summary IBM Event Streams has addressed the following vulnerability Vulnerability Details CVEID: CVE-2019-12399 DESCRIPTION: Apache Kafka could allow a remote attacker to obtain sensitive information, caused by a flaw in the Connect REST API. By sending specially crafted request, a remote attacke...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Event Streams

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Event Streams. IBM Event Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2762 DESCRIPTION: An unspecified vulnerability related to the Java SE Utilities component...

Security Bulletin: IBM Event Streams is affected by OpenSSL vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the OpenSSL versions shipped. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC group missing...

Security Bulletin: IBM Event Streams is affected by jackson-databind vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the jackson-databind versions shipped. Vulnerability Details CVEID: CVE-2019-12814 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to obtain sensitive information, caused by a polymorphic typing issue. ...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Event Streams

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Event Streams. IBM Event Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-10245 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a denial of service, caused by the...

Security Bulletin: IBM Event Streams is affected by kubectl vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the kubectl versions shipped. Vulnerability Details CVEID: CVE-2019-1002101 DESCRIPTION: Kubernetes could allow a remote attacker to traverse directories on the system, caused by the improper handling of symlinks. By...

Security Bulletin: IBM Event Streams is affected by Apache ZooKeeper vulnerability CVE-2019-0201

Summary IBM Event Streams has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-0201 DESCRIPTION: Apache ZooKeeper could allow a remote attacker to obtain sensitive information, caused by the failure to check permissions by the getACL command. By sending a...

Security Bulletin: IBM Event Streams is affected by jackson-databind vulnerability CVE-2019-12086

Summary IBM Event Streams has addressed the following vulnerability Vulnerability Details CVEID: CVE-2019-12086 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to obtain sensitive information, caused by a Polymorphic Typing issue that occurs due to missing...

Security Bulletin: IBM Event Streams is affected by Go vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the Go Runtimes shipped. Vulnerability Details CVEID: CVE-2019-9741 DESCRIPTION: Golang GO is vulnerable to HTTP header injection, caused by improper validation of input in the http.NewRequest. By sending a specially-crafted...