PT-2022-10808

Name of the Vulnerable Software and Affected Versions IBM System Storage DS8000 Management Console HMC versions 88.5x.x.x through 89.2x.0.0 Description The issue allows a remote attacker to obtain sensitive information through unpublished URLs. Recommendations For versions 88.5x.x.x through...

PT-2022-10806

Name of the Vulnerable Software and Affected Versions IBM System Storage DS8000 Management Console HMC versions 88.5x.x.x through 89.2x.0.0 Description The issue allows a remote attacker to obtain sensitive information through unpublished URLs. Recommendations For versions 88.5x.x.x through...

IBM System Storage DS8000 Hardware Management Console 安全漏洞

The IBM System Storage DS8000 Hardware Management Console IBM System Storage DS8000 HMC is a hardware management console for the IBM Storage Media Platform DS8000 from IBM in the United States. A security vulnerability exists in IBM System Storage DS8000 Management Console HMC R8.5 88.5x.x.x, R9....

CVE-2021-38929: Undefined Security Weakness

IBM System Storage DS8000 Management Console HMC R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive information through unpublished URLs. IBM X-Force ID: 210330...

CVE-2021-38930: Undefined Security Weakness

IBM System Storage DS8000 Management Console HMC R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive information through unpublished URLs. IBM X-Force ID: 210331...

Security Bulletin: This Power System update is being released to address CVE 2021-38960

Summary POWER9: In response to a security issue with BMC's HTTPS server, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2021-38960 Vulnerability Details CVEID: CVE-2021-38960 DESCRIPTION: IBM OPENBMC could allow an...

Security Bulletin: Vulnerability in Apache Log4j (CVE-2021-44228) affects Power HMC

Summary Log4j is used by IBM Power Hardware Management Console HMC for logging system/application events for diagnostics. This bulletin provides a remediation for the vulnerability, CVE-2021-44228 by upgrading IBM Power Hardware Management Console HMC respective PTF and thus addressing the exposu...

Security Bulletin: This Power System update is being released to address CVE-2018-0732

Summary POWER9: In response to a denial of service vulnerability in OpenSSL, a new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-0732. A malicious server can send a large prime value to a client during DHE TLS handshake causi...

Security Bulletin: This Power System update is being released to address CVE 2020-25705

Summary POWER9: In response to security issues with BMC's UDP network service, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2020-25705. Vulnerability Details CVEID: CVE-2020-25705 DESCRIPTION: Linux Kernel could allow a remo...

PT-2021-8197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a user-after-free vulnerability in the add pble prm function within the InfiniBand driver of the Linux kernel. This vulnerability occurs when the irdma hmc sd one...

Security Bulletin: Vulnerability in Bash (CVE-2019-18276) affects HMC

Summary GNU Bash is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-18276 DESCRIPTION: GNU Bash could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw in the disableprivmode...

Security Bulletin: Vulnerability in Apache HTTP (CVE-2018-17199 and CVE-2020-11993) affects HMC

Summary Apache HTTP is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE's. Vulnerability Details CVEID: CVE-2018-17199 DESCRIPTION: Apache HTTP Server could allow a remote attacker to bypass security restrictions, caused by checking the session expiry time befor...

Security Bulletin: Vulnerability in MIT Kerberos 5 (CVE-2020-28196) affects HMC

Summary MIT Kerberos 5 krb5 is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-28196 DESCRIPTION: MIT Kerberos 5 aka krb5 is vulnerable to a denial of service, caused by an unbounded recursion flaw in...

Security Bulletin: Vulnerability in Apache Tomcat (CVE-2021-42340) affects HMC

Summary Apache Tomcat is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-42340 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by a memory leak flaw in WebSocket connections. By sending a...

Security Bulletin: Vulnerability in glib2 (CVE-2021-27218 and CVE-2021-27219) affects Power HMC

Summary glib2 is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-27218 DESCRIPTION: GNOME GLib is vulnerable to a denial of service, caused by an error when invoking gbytearraynewtake with a buffer of 4GB or more on a...

Security Bulletin: Vulnerability in bind (CVE-2021-25215) affects Power HMC

Summary BIND is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-25215 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an assertion failure while answering queries for DNAME records. By sending a query...

Security Bulletin: Vulnerability in Xerces-C (CVE-2018-1311)

Summary Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. XML parser contains a...

Security Bulletin: Vulnerability in libssh affects Power Hardware Management Console (CVE-2020-1730).

Summary libssh is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-1730 DESCRIPTION: libssh is vulnerable to a denial of service, caused by the use of uninitialized AES-CTR ciphers. A remote attacker could exploit this...

Security Bulletin: Vulnerability in bind (CVE-2021-25215)

Summary BIND is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-25215 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an assertion failure while answering queries for DNAME records. By sending a query...

Security Bulletin: This Power Hardware Management Console (HMC) Security Bulletin is being released to address Common Vulnerabilities and Exposures issue numbers CVE-2018-3639 (Variant 4) and CVE-2018-3640 (Variant 3a).

Summary In response to recently reported security vulnerabilities, this Power HMC Security Bulletin is released to address Common Vulnerabilities and Exposures issue numbers CVE-2018-3639 and CVE-2018-3640. Vulnerability Details CVEID: CVE-2018-3639 CVEID: CVE-2018-3640 Workarounds and Mitigation...