Security Bulletin: The IBM® Engineering Lifecycle Engineering products using IBM WebSphere Application Server Liberty is vulnerable to a denial of service (CVE-2023-44487)

Summary IBM WebSphere Application Server Liberty is vulnerable to a denial of service with the servlet-3.1, servlet-4.0, servlet-5.0, or servlet-6.0 feature with the HTTP/2 protocol enabled. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been...

Security Bulletin: IBM Security SOAR is using a component with a known vulnerability [CVE-2023-46604]

Summary IBM Security SOAR uses an older version of Apache ActiveMQ that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended customers upgrade to the latest applicable fix pack. CVE-2023-46604 Vulnerability Details...

Security Bulletin: Modification of Assumed-Immutable Data (MAID) affects IBM Financial Transaction Manager for SWIFT Services (CVE-2023-49880)

Summary Modification of Assumed-Immutable Data MAID affects the MER facility of IBM Financial Transaction Manager for SWIFT Services. This vulnerability is addressed. Vulnerability Details CVEID:CVE-2023-49880 DESCRIPTION: In the Message Entry and Repair MER facility of Financial Transaction...

Security Bulletin: IBM® Db2® federated server is vulnerable to a denial of service when a specially crafted cursor is used. (CVE-2023-46167)

Summary IBM® Db2® federated server is vulnerable to a denial of service when a specially crafted cursor is used. Vulnerability Details CVEID:CVE-2023-46167 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server federated server is vulnerable to a denial of service when a...

Security Bulletin: IBM® Db2® could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. (CVE-2023-47701)

Summary IBM® Db2® could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. Vulnerability Details CVEID:CVE-2023-47701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated user with...

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted query. (CVE-2023-43020)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted query. Vulnerability Details CVEID:CVE-2023-43020 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted query. CVSS Base score: 6.5 CVSS...

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement. (CVE-2023-38727)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement. Vulnerability Details CVEID:CVE-2023-38727 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted SQL statement. CVSS Base...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by AIX. AIX has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK related to the JSSE component...

Security Bulletin: IBM MQ is vulnerable to a denial of service (CVE-2023-5072)

Summary IBM MQ has resolved a denial of service vulnerability. Vulnerability Details CVEID:CVE-2023-5072 DESCRIPTION: JSON-java is vulnerable to a denial of service, caused by a bug in the parser. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause ...

Security Bulletin: IBM MQ Appliance is vulnerable to a denial of service (CVE-2023-4807)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID:CVE-2023-4807 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a state corruption flaw in the POLY1305 MAC message authentication code implementation, when running on newer X86...

Security Bulletin: IBM MQ Appliance is affected by multiple Java vulnerabilitites (CVE-2023-22081 and CVE-2023-5676)

Summary IBM MQ Appliance has resolved multiple Java vulnerabilities. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow a remote attacker to cause no confidentiality impact, no integrity impact, and low...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL. (CVE-2023-3446)

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL. CVE-2023-3446 Vulnerability Details CVEID:CVE-2023-3446 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using the DHcheck, DHcheckex or EVPPKEYparamcheck functions to check a D...

Security Bulletin: A vulnerability in cryptography-3.3.2-cp36-abi3-manylinux2010_x86_64.whl affects Data Replication on Cloud Pak for Data

Summary A vulnerability in cryptography-3.3.2-cp36-abi3-manylinux2010x8664.whl has been addressed. Vulnerability Details CVEID:CVE-2023-0286 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a type confusion error related to X.400 address processing inside an X.509 GeneralName...

Security Bulletin: A vulnerability in github.com/golang/text/language-v0.3.0 affects Data Replication on Cloud Pak for Data

Summary A vulnerability in the package github.com/golang/text/language-v0.3.0 has been addressed. Vulnerability Details CVEID:CVE-2022-32149 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation by the golang.org/x/text/language package. By sending a...

Security Bulletin: Vulnerabilities in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2023-41835)

Summary Apache Struts is used by Tivoli Netcool/OMNIbus WebGUI as part of its web client component. The fix includes Apache Struts v2.5.32. Vulnerability Details CVEID:CVE-2023-41835 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by an incomplete cleanup of the...

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted query containing common table expressions (CVE-2023-40373)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted query containing common table expressions. Vulnerability Details CVEID:CVE-2023-40373 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially...

Security Bulletin: IBM® Db2® is vulnerable to denial of service via a specially crafted query on certain databases. (CVE-2023-30987)

Summary IBM® Db2® is vulnerable to denial of service via a specially crafted query on certain databases. Vulnerability Details CVEID:CVE-2023-30987 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially...

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2023-30991)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted query. Vulnerability Details CVEID:CVE-2023-30991 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted query. CVSS Base score: 7.5 CVSS...

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted ALTER TABLE statement (CVE-2023-38720)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted ALTER TABLE statement. Vulnerability Details CVEID:CVE-2023-38720 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted ALTER TABLE...

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted XML query statement (CVE-2023-38728)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted XML query statement. Vulnerability Details CVEID:CVE-2023-38728 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted XML query statemen...