Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-44716, CVE-2021-44717)

Summary Security Vulnerabilities affect IBM Cloud Private - Golang Vulnerability Details CVEID: CVE-2021-44716 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an uncontrolled memory consumption in the header canonicalization cache in net/http. By sending HTTP/2 requests, a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-41772,CVE-2021-41771)

Summary Security Vulnerabilities affect IBM Cloud Private - Golang Vulnerability Details CVEID: CVE-2021-41772 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an out-of-bounds slice situation in the Reader.Open function. By using a specially-crafted ZIP archive containing a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-22959, CVE-2021-22960)

Summary Security Vulnerabilities affect IBM Cloud Private - Node.js Vulnerability Details CVEID: CVE-2021-22959 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by an error related to a space in headers. A remote attacker could send a specially-crafted request with a space SP...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Kubernetes (CVE-2021-25741)

Summary Security Vulnerabilities affect IBM Cloud Private - Kubernetes Vulnerability Details CVEID: CVE-2021-25741 DESCRIPTION: Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a symlink exchange flaw in kubelet. By sending a specially-crafted...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22945)

Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID: CVE-2021-22945 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a use-after-free and double free flaw when sending data to an MQTT server. By sending a specially-crafted data, a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22946)

Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID: CVE-2021-22946 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a required TLS bypassed issue. By sniffing the network, an attacker could exploit this...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Apache Commons Compress (CVE-2021-35517, CVE-2021-36090)

Summary Security Vulnerabilities affect IBM Cloud Private - Apache Commons Compress Vulnerability Details CVEID:CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocating large amounts of memory. By persuading a victi...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - IBM WebSphere Application Server (CVE-2021-29842)

Summary Security Vulnerabilities affect IBM Cloud Private - IBM WebSphere Application Server Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-39135)

Summary Security Vulnerabilities affect IBM Cloud Private - Node.js Vulnerability Details CVEID: CVE-2021-39135 DESCRIPTION: Node.js @npmcli/arborist module could allow a local attacker to launch a symlink attack. By replacing the nodemodules folder of the root project or any of its dependencies...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Java (Multiple CVEs)

Summary Security Vulnerabilities affect IBM Cloud Private - Java Vulnerability Details CVEID: CVE-2021-2388 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to take control of the system. CVSS Base score: 7.5 CVSS Temporal...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-33196)

Summary Security Vulnerabilities affect IBM Cloud Private - Golang Vulnerability Details CVEID: CVE-2021-33196 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the NewReader and OpenReader functions in archive/zip. By persuading a victim to open a specially-crafted...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22924)

Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID: CVE-2021-22924 DESCRIPTION: An unspecified error with bad connection reused due to improper path name validation in cURL libcurl has an unknown impact and attack vector. CVSS Base score: 5.3 CVSS Tempora...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22925)

Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID:CVE-2021-22925 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a flaw in the option parser for sending NEWENV variables. By sniffing the network traffic,...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-34558)

Summary Security Vulnerabilities affect IBM Cloud Private - Golang Vulnerability Details CVEID: CVE-2021-34558 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by the failure to properly assert that the type of public key in an X.509 certificate matches the expected type in the...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - xrdp package for Alpine Linux (CVE-2021-36158)

Summary Security Vulnerabilities affect IBM Cloud Private - xrdp package for Alpine Linux Vulnerability Details CVEID: CVE-2021-36158 DESCRIPTION: xrdp package for Alpine Linux is vulnerable to a man-in-the-middle attack, caused by improper generation of RSA certificates and private keys in the R...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - MongoDB (CVE-2021-20329)

Summary Security Vulnerabilities affect IBM Cloud Private - MongoDB Vulnerability Details CVEID: CVE-2021-20329 DESCRIPTION: MongoDB Go Driver could allow a remote authenticated attacker to bypass security restrictions, caused by improper input validation of cstrings when marshalling Go objects...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22898)

Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID: CVE-2021-22898 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a flaw in the option parser for sending NEWENV variables. By sending a specially-crafted...

Cisco Releases Security Patches for TelePresence, RoomOS and Umbrella VA

Networking equipment maker Cisco has released security updates to address three high-severity vulnerabilities in its products that could be exploited to cause a denial-of-service DoS condition and take control of affected systems. The first of the three flaws, CVE-2022-20783 CVSS score: 7.5,...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - NGINX (CVE-2019-20372)

Summary A Security Vulnerability affects IBM Cloud Private Vulnerability Details CVEID: CVE-2019-20372 DESCRIPTION: NGINX could allow a remote attacker to obtain sensitive information, caused by a flaw in certain errorpage configurations. By sending a specially crafted request, a remote attacker...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - nginx (CVE-2018-16844, CVE-2018-16845, CVE-2018-16843, CVE-2019-7401)

Summary Security Vulnerabilities affect IBM Cloud Private - nginx Vulnerability Details CVEID: CVE-2018-16844 DESCRIPTION: nginx is vulnerable to a denial of service, caused by a flaw when complied with ngxhttpv2module. By sending a specially-crafted HTTP/2 request, a remote attacker could exploi...