Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 affects CICS Transaction Gateway

Summary There is a vulnerability which is related to identity spoofing in IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2022-22476...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to information disclosure due to Apache James MIME4J (CVE-2022-45787)

Summary There is a vulnerability in the Apache James MIME4J library used by IBM WebSphere Application Server Liberty when the feature restfulWS-3.0 is enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-45787 DESCRIPTION: Apache James MIME4J could allow a local authenticated...

Security Bulletin: IBM MQ is affected by an identity spoofing issue in IBM WebSphere Application Server Liberty (CVE-2022-22475)

Summary An identity spoofing issue was found within IBM WebSphere Application Server Liberty, which IBM MQ uses to provide WebConsole and REST API functionality. Vulnerability Details CVEID:CVE-2022-22475 DESCRIPTION: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through...

IBM WebSphere Application Server Liberty 注入漏洞

IBM WebSphere Application Server Liberty is a Java application server from International Business Machines IBM built on top of the Open Liberty project. A security vulnerability exists in IBM WebSphere Application Server Liberty that stems from improper input validation of the HOST header...

Security Bulletin: Vulnerabilities in IBM WebSphere Liberty affects IBM InfoSphere Global Name Management (CVE-2022-22475, CVE-2022-22476)

Summary The IBM WebSphere Liberty used in IBM InfoSphere Global Name Management is vulnerable to identity spoofing by an authenticated user. This issue only affects ENS, a part of GNM 6 installed by a small minority of GNM customers. For GNM customers not using ENS, there is no vulnerability...

Security Bulletin: Vulnerability in IBM WebSphere Liberty affects IBM InfoSphere Global Name Management (CVE-2022-34165)

Summary The IBM WebSphere Liberty used in IBM InfoSphere Global Name Management is vulnerable to HTTP header injection when processing web requests. This problem is addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to the October 2022 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to HTTP header injection and affected by denial of services due to multiple vulnerabilities.

Summary IBM WebSphere Application Server Liberty for IBM i is vulnerable to an HTTP header injection caused by improper validation, and affected by a denial of service in GraphQL Java, a denial of service in CyberNeko HTML, and a denial of service in protobuf-java as described in the vulnerabilit...

Security Bulletin: IBM WebSphere Application Server Liberty used by IBM Cloud Pak for Watson AIOps is vulnerable to HTTP header injection (CVE-2022-34165)

Summary A vulnerability was identified within the IBM WebSphere Application Server Liberty library that is used by IBM Cloud Pak for Watson AIOps. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0...

Security Bulletin: HTTP header injection vulnerability in Watson Knowledge Catalog for IBM Cloud Pak for Data (CVE-2022-34165)

Summary Watson Knowledge Catalog for IBM Cloud Pak for Data has an internal dependency on IBM WebSphere Application Server Liberty. Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to a HTTP header injection. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-34165...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2022-3509 DESCRIPTION: protobuf-java core and lite are vulnerable to a denial of service, caused by a flaw in the parsing...

Security Bulletin: Vulnerabilities in the protobuf-java may affect IBM Robotic Process Automation and could result in a denial of service (CVE-2022-3171, CVE-2022-3509)

Summary There is a vulnerability in protobuf-java used by IBM WebSphere Liberty which may result in a denial of service. IBM Robotic Process Automation for Cloud Pak uses IBM WebSphere Liberty as part of it's User Management Services. This bulletin identifies the security fixes to apply to addres...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using WebSphere Application Server Liberty is vulnerable to denial of service due to Google protobuf-java (CVE-2022-3509, CVE-2022-3171)

Summary There is a vulnerability in the Google protobuf-java library used by IBM WebSphere Application Server Liberty with the grpc-1.0 or grpcClient-1.0 feature enabled. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has been addressed in this bulletin:...

Security Bulletin: A security vulnerability ( CVE-2022-34165 ) has been identified in IBM WebSphere Application Server traditional and IBM WebSphere Application Server Liberty shipped with IBM Operations Analytics Predictive Insights

Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. IBM WebSphere Application Server Liberty profile is used in the UI component of IBM Operations Analytics Predictive Insights. The vulnerability CVE-2022-34165 has been addressed and...

Security Bulletin: Vulnerability in WebSphere Application Server Liberty affect IBM Cloud Pak System (CVE-2022-37734)

Summary Vulnerability has been identified in WebSphere Application Server Liberty shipped with Cloud Pak System. Information about vulnerability has been published in security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products...

Security Bulletin: Liberty is vulnerable to denial of service due to GraphQL Java affecting IBM TXSeries for Multiplatforms

Summary Liberty is vulnerable to a denial of service due to GraphQL Java mpGraphQL-1.0 or mpGraphQL-2.0 caused by an uncontrolled resource consumption flaw. This affects WebSphere Application Server Liberty versions 17.0.0.3 - 22.0.0.11 used by IBM TXSeries for Multiplatforms. IBM TXSeries for...

Security Bulletin: IBM® MobileFirst Platform on Red Hat® OpenShift® is vulnerable to Http Header injection due to IBM WebSphere® Liberty version used (CVE-2022-34165)

Summary IBM Websphere Liberty is the stack on top of which the MobileFirst runtime is hosted. The Liberty version that is packaged with the MobileFirst Platform on RHOS uses an older Liberty version 19.0.0.5 which is impacted by the vulnerability described in CVE-2022-34165 Vulnerability Details...

Security Bulletin: A vulnerability in IBM Java Runtime affects SPSS Collaboration and Deployment Services (CVE-2021-28167)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 8 used by SPSS Collaboration and Deployment Services. This issue has been addressed. Vulnerability Details CVEID:CVE-2021-28167 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions,...

Upgradable liberty

Lines of code Vulnerability details Impact Instead of using @openzeppelin/contracts, use the upgradable liberty for contracts that should be able to be upgraded. This is the library that should be used :@openzeppelin/contracts-upgradeable Proof of Concept For more info have a look at this resourc...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to spoofing attacks due to WAS Liberty (CVE-2018-25031, CVE-2021-46708)

Summary IBM Sterling Partner Engagement Manager has addressed all vulnerabilities published by WAS liberty below. Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, a...