Updated tomcat packages fix a security vulnerability

When serving resources from a network location using the NTFS file system it was possible to bypass security constraints and/or view the source code for JSPs in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath which in turn was caused by the...

Security Bulletin: A vulnerability exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager (CVE-2020-2590).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Configuration Manager IP Edition v6.4.2, which was disclosed in the Oracle January 2020 Critical Patch Update, but deferred until the release associated with the Oracle Oct 2020...

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager (CVE-2020-2590).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle January 2020 Critical Patch Update, but deferred until the release associated with the Oracle Oct 2020 Critical Patch...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Synergy (CVE-2016-3426)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 20 that is used by IBM Rational Synergy. These issues were disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details CVEID: CVE-2016-3426...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Synergy (CVE-2016-0475 and CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 15 and earlier releases that is used by Rational Synergy. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the...

Security Bulletin: Rational Synergy vulnerability (CVE-2014-4263, CVE-2014-3068,CVE-2014-3566,CVE-2014-6457)

Summary A possible security vulnerability has been reported in the JSSE component of IBM Java shipped with Rational Synergy. Vulnerability Details CVE-ID: CVE-2014-4263 Description: An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrit...

Security Bulletin: Unspecified Vulnerabilities in Rational Synergy (CVE-2012-0502,CVE-2012-0503,CVE-2012-0506,CVE-2012-0507,CVE-2011-3563,CVE-2012-0500,CVE-2012-0497,CVE-2012-0498,CVE-2012-0499,CVE-2012-0500,CVE-2012-0501,CVE-2012-0505,CVE-2011-5035)

Summary Vulnerabilities in the Java Runtime Environment JRE 6 update 32 and earlier component shipped with IBM Rational Synergy may affect the security of the product. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Rational Synergy

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6 Service Refresh 16 Fix Pack 30 and earlier releases used by IBM Rational Synergy. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017. Vulnerability Details If you run your own Java code...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Synergy (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931 and CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6.0 SR16 FP5 that is used by Rational Synergy. These issues were disclosed as part of the IBM Java SDK updates in July and October 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION:...

Security Bulletin: Rational Synergy vulnerability (CVE-2014-0453, CVE-2014-0411)

Summary A possible security vulnerability has been reported in the Rational Synergy. There have been no reported exploits of this possible vulnerability, which is located in the JSSE component of IBM Java shipped with the tool and its agent. Vulnerability Details | Subscribe to My Notifications t...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Synergy (CVE-2015-0138, CVE-2014-6593,CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM Rational Synergy. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client...

Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Synergy (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Rational Synergy. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

CVE-2020-16971 vulnerabilities

Vulnerabilities for packages: logstash...

Security Bulletin: JRE vulnerability (CVEID: 178768) impacts IBM Aspera High-Speed Transfer Server/IBM Aspera High-Speed Transfer Endpoint version 3.9.6.2 and earlier

Summary JRE vulnerability TPS0000256, CVEID: 178768 impacts IBM Aspera High-Speed Transfer Server/IBM Aspera High-Speed Transfer Endpoint version 3.9.6.2 and earlier. The fix for this set of vulnerabilities was delivered in IBM Aspera High-Speed Transfer Server V4.0.0 and IBM Aspera High-Speed...

Security Bulletin: Multiple vulnerabilities in IBM Java JRE, 8.0-1.1 affect IBM Netezza Platform Software clients.

Summary IBM Java JRE 8.0-1.1 is used by IBM Netezza Platform Software. IBM Netezza Platform Software has addressed the applicable CVEs by upgrading the IBM Java JRE to latest version 8.0-5.41, provided through PDA version 7.2.1.9-P1 will help resolve following CVEs. Vulnerability Details CVEID:...

Apache Cassandra < 2.1.22 / 2.2.x < 2.2.18 / 3.0.x < 3.0.22 / 3.11.x < 3.11.8 Information Disclosure Vulnerability

The version of Apache Cassandra running on the remote host is prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2. It is, therefore, affected by information disclosure vulnerability. An unauthenticated, local attacker without access to the Apache Cassandra process or configuration files can...

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager (CVE-2019-2601).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle January 2020 Critical Patch Update, but deferred until the release associated with the Oracle Oct 2020 Critical Patch...

Fixed in Apache Tomcat 10.0.0-M10

Important: Information disclosure CVE-2021-24122 When serving resources from a network location using the NTFS file system it was possible to bypass security constraints and/or view the source code for JSPs in some configurations. The root cause was the unexpected behaviour of the JRE API...

Fixed in Apache Tomcat 9.0.40

Important: Information disclosure CVE-2021-24122 When serving resources from a network location using the NTFS file system it was possible to bypass security constraints and/or view the source code for JSPs in some configurations. The root cause was the unexpected behaviour of the JRE API...

Security Bulletin: Multiple vulnerabilities in IBM JRE, Java Technology Edition may affect IBM License Key Server Administration & Reporting Tool and Agent

Summary There are multiple vulnerabilities in IBM JRE, Java Technology Edition used by IBM License Key Server Administration & Reporting Tool and Agent. A fix has been released to mitigate the issues. Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified vulnerability in Java SE...