Security Bulletin: Vulnerabilities in XML processing affect IBM DataPower Gateways

Summary IBM DataPower Gateways has addressed vulnerabilities in processing certain XML files that could cause a denial of service. Vulnerability Details CVEID: CVE-2015-5312 DESCRIPTION: An unspecified error in Libxml2 related to an entity expansion flaw has an unknown impact and attack vector...

Security Bulletin: IBM DataPower Gateway has released a fixpack in response to the vulnerability known as Spectre.

Summary IBM has released the following fixpack for IBM DataPower Gateways in response to CVE-2017-5753. Vulnerability Details CVEID: CVE-2017-5753 Affected Products and Versions IBM DataPower Gateways appliances, versions 7.1.0.0-7.1.0.21, 7.2.0.0-7.2.0.18, 7.5.0.0-7.5.0.12, 7.5.1.0-7.5.1.11,...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM DataPower Gateway Appliances (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM DataPower Gateway Appliances. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateway appliances (CVE-2014-3570, CVE-2015-0204)

Summary SSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. IBM DataPower Gateway has addressed the corresponding applicable CVEs. Vulnerability Details CVEID: CVE-2014-35...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways

Summary SSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2108 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a buffer...

Security Bulletin: Potential exposure of sensitive data in IBM DataPower Gateway (CVE-2020-4203)

Summary IBM DataPower Gateway could permit privileged users to view certain internal directories. IBM has addressed the CVE. Vulnerability Details CVEID: CVE-2020-4203 DESCRIPTION: IBM DataPower Gateway could potentially disclose highly sensitive information to a privileged user due to improper...

Security Bulletin: IBM DataPower Monitor is potentially vulnerable to an authentication bypass (CVE-2020-8172)

Summary IBM has addressed the relevant CVE CVE-2020-8172 Vulnerability Details CVEID: CVE-2020-8172 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions. The 'session' event could be emitted before the 'secureConnect' event and possibly allow for the reuse of the TLS...

Security Bulletin: Certificates not removed from DataPower ValCred when updating corresponding APIc truststore (CVE-2020-4205)

Summary When a certificate is removed from an APIc TrustStore, the correspsonding DataPower ValCred may not be updated to match. Vulnerability Details CVEID: CVE-2020-4205 DESCRIPTION: IBM DataPower Gateway could allow an authenticated user to bypass security restrictions, and continue to access...

Security Bulletin: IBM DataPower Gateway can expose remote credentials to local users (CVE-2020-4528)

Summary Passwords provided as part of a URL for an administrative COPY command may appear in the administrative log. If the password is not provided in the URL, it will be prompted for, and will not appear in the log. Vulnerability Details CVEID: CVE-2020-4528 DESCRIPTION: IBM MQ Appliance could...

Security Bulletin: Vulnerabities in SSL in IBM DataPower Gateway

Summary IBM DataPower Gateway has addressed two CVEs relating to SSL: CVE-2019-1559 & CVE-2018-0734 Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, and once to receive one then...

Security Bulletin: Potential side-channel cryptographic vulnerabilities in IBM DataPower Gateway

Summary IBM DataPower Gateway is potentially vulnerable to two side-channel attacks CVE-2018-0495, CVE-2018-12404 Vulnerability Details CVEID: CVE-2018-0495 DESCRIPTION: Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be...

Security Bulletin: IBM DataPower Gateway is potentially vulnerable to two cryptographic side-channel vulnerabilities in SSL.

Summary Side-channel vulnerabilities in SSL CVE-2019-1563, CVE-2019-1547 potentially affect IBM DataPower Gateway Vulnerability Details CVEID: CVE-2019-1563 DESCRIPTION: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker,...

Security Bulletin: Potential TLS vulnerability using Diffie-Hellman TLS ciphersuites in IBM DataPower Gateway (CVE-2020-1968)

Summary IBM has addressed the relevant CVE CVE-2020-1968 Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections which have...

Security Bulletin: IBM DataPower Gateway is potentially vulnerable to a DoS issue when processing regular expressions (CVE-2017-16231)

Summary IBM has addressed the following CVE: CVE-2017-16231 Vulnerability Details CVEID: CVE-2017-16231 DESCRIPTION: PCRE is vulnerable to a denial of service, caused by a buffer overflow in the match function in pcreexec.c. By persuading a victim to open a specially crafted file, a remote attack...

Security Bulletin: IBM DataPower Gateway is affected by vulnerabilities in OpenSSL

Summary IBM DataPower Gateway has addressed the following vulnerabilities: CVE-2018-0734 CVE-2018-5407 Vulnerability Details CVEID: CVE-2018-0734 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing side channel attack in the DSA signature...

Security Bulletin: Multiple vulnerabilities may affect JRE in IBM DataPower Gateway

Summary IBM has addressed the relevant CVEs Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using...

Security Bulletin: IBM DataPower Gateway enables default IPMI account

Summary If IPMI over LAN Is enabled, a default administrator account is also enabled. Vulnerability Details CVEID: CVE-2019-4621 DESCRIPTION: IBM DataPower Appliance and IBM MQ Appliance have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker cou...

Security Bulletin: IBM DataPower Gateway GUI permits use of GET

Summary The IBM DataPower GUI uses HTTP POST for operations that require information from the client. However, the GUI also responds to GET operations on the same URLs. While such GET operations are never initiated by the GUI, use of GET in such a manner could reveal sensitive information, so the...

Security Bulletin: IBM DataPower Gateway vulnerable to an RCE attack (CVE-2020-5014)

Summary IBM has addressed the relevant CVE Vulnerability Details CVEID: CVE-2020-5014 DESCRIPTION: IBM DataPower Gateway could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. CVSS Base score: 6.7 CVSS Tempor...

Security Bulletin: Potential disclosure of information in IBM DataPower Gateway (CVE-2018-14348)

Summary IBM DataPower Gateway has addressed CVE 2018-14348 Vulnerability Details CVEID: CVE-2018-14348 DESCRIPTION: libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information. CVSS Base score: 5.3 CVSS Temporal...