Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple vulnerabilities due to its use of IBM JAVA (CVE-2021-35560, CVE-2021-35578, CVE-2021-35565, CVE-2021-35603)

Summary IBM Java is the runtime environment used by several components in IBM Cloud Pak for Multicloud Management Monitoring and contains several security vulnerabilities. Vulnerability Details CVEID: CVE-2021-35560 DESCRIPTION: An unspecified vulnerability in Java SE related to the Deployment...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to a denial server due to its use of Apache Xerces2 (CVE-2022-23437)

Summary Apache Xerces2 is used by several components in IBM Cloud Pak for Multicloud Management Monitoring to process internal configuration files. This vulnerability is limited to a malicious insider who can find and manipulate these files. Vulnerability Details CVEID: CVE-2022-23437 DESCRIPTION...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities due to its use of NodeJS (CVE-2021-22918, CVE-2021-22960, CVE-2021-22959)

Summary NodeJS is used by multiple components of IBM Cloud Pak for Multicloud Management Monitoring as a runtime environment. Vulnerability Details CVEID: CVE-2021-22959 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by an error related to a space in headers. A remote attack...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is potentially vulnerable to execution of arbitrary code due to its use of Apache Log4j (CVE-2021-4104)

Summary Apache Log4j is used by IBM Cloud Pak for Multicloud Management Monitoring as part of its logging infrastructure. Apache Log4j v1.2 has been removed and replaced by Log4j v2.17.1. Components that use Apache Log4j v1.2 are not exposed outside the cluster and are not configured to use the...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to directory traversal due to its use of Apache Commons IO (CVE-2021-29425)

Summary Apache Commons IO is used by several components in IBM Cloud Pak for Multicloud Management Monitoring. The product does not allow input that processes files or directories, but the affected software has been updated out of an abundance of caution. Vulnerability Details CVEID: CVE-2021-294...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to several attack vectors due to its use of Apache Netty (CVE-2021-37136, CVE-2021-37137, CVE-2021-43797)

Summary Several security vulnerablities were found in the Apache Netty library used by several components in IBM Cloud Pak for Multicloud Management Monitoring. Vulnerability Details CVEID: CVE-2021-37136 DESCRIPTION: Netty netty-codec is vulnerable to a denial of service, caused by not allow siz...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of IBM Websphere Liberty (CVE-2021-35517, CVE-2021-36090)

Summary IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of IBM Websphere Liberty. IBM Websphere Liberty is uses as a middleware server. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service,...

Security Bulletin: IBM Cloud Pak for Multicloud Management is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Apache Log4j CVE-2021-45105 and CVE-2021-45046 is used by the Monitoring component of IBM Cloud Pak for Multicloud Management as part of its logging infrastructure. The fix includes Apache Log4j v2.17.1. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable t...

Security Bulletin: IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Log4j for CVE-2021-44228

Summary IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Log4j for CVE-2021-44228. Log4j is used by various microservices either directly or indirectly through dependent open source software for logging messages to files. Vulnerability Details CVEID: CVE-2021-4422...

Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC.

Summary Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC. Vulnerability Details CVEID: CVE-2021-34558 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by the failure to properly assert that the type of public key in an...

Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring

Summary There are multiple vulnerabilities in Mozilla Firefox that affect IBM Cloud Pak for Multicloud Management Monitoring. Vulnerability Details CVEID: CVE-2021-29988 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by incorrect style...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoringhas applied security fixes for its use of Mozilla Firefox

Summary IBM Cloud Pak for Multicloud Management Monitoringhas applied security fixes for its use of Mozilla Firefox. Vulnerability Details CVEID: CVE-2021-29976 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoringhas applied security fixes for its use of Mozilla Firefox

Summary IBM Cloud Pak for Multicloud Management Monitoringhas applied security fixes for its use of Mozilla Firefox. Vulnerability Details CVEID: CVE-2021-29967 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of Mozilla Firefox

Summary IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of Mozilla Firefox. Vulnerability Details CVEID: CVE-2021-23994 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by by an out-of-bounds write...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of Netty.io

Summary IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of Netty.io. Vulnerability Details CVEID: CVE-2020-11612 DESCRIPTION: Netty is vulnerable to a denial of service, caused by unbounded memory allocation while decoding a ZlibEncoded byte stream in the...

Security Bulletin: IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Apache Commons

Summary IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Apache Commons. Vulnerability Details CVEID: CVE-2020-1953 DESCRIPTION: Apache Commons Configuration could allow a remote attacker to execute arbitrary code on the system, caused by an issue when allowing th...

Security Bulletin: A security vulnerability in PostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management.

Summary A security vulnerability in PostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management. Vulnerability Details CVEID: CVE-2021-32027 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an integer...

Security Bulletin: A security vulnerability in PostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management.

Summary A security vulnerability in PostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management. Vulnerability Details CVEID: CVE-2021-32028 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to obtain sensitive information, caused by a memory disclosure...

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services. Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on...

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services. Vulnerability Details CVEID: CVE-2021-22918 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an out-of-bounds read in the libuv's...