Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow in Perl (CVE-2020-12723).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow in Perl, caused by recursive Sstudychunk calls in regcomp.c CVE-2020-12723. This could allow a remote attacker to overflow a buffer and execute arbitrary code on the system. Perl is included...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-23772).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go, caused by a buffer overflow in the Rat.SetString function in math/big CVE-2022-23772. Attackers could exploit this vulnerability to consume large amounts of RAM and cause the...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-24921).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go, caused by improper input validation, which may be exploited to cause a goroutine stack exhaustion CVE-2022-24921. Golang Go is included in some of the operators used in IBM...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Git (CVE-2021-40330)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Git , caused by improper input validation by the gitconnectgit function in connect.c CVE-2021-40330. Git is included in the base operating system used by IBM Watson Speech...

Security Bulletin: A Python Issue Affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

Summary A flaw in our RedHat Base OS image was found for python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this...

Security Bulletin: A vulnerability in Apache Tomcat affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

Summary A vulnerability in Apache Tomcat affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data. Please see below for details on how to remediate this issue. Vulnerability Details CVEID:CVE-2022-23181 DESCRIPTION: Apache Tomcat could allow a local authenticated attacker to gain...

Security Bulletin: A Cyrus SASL vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2022-24407)

Summary A Cyrus SASL vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data CVE-2022-24407. Please see below for details on how to remediate this issue. Vulnerability Details CVEID:CVE-2022-24407 DESCRIPTION: Cyrus SASL is vulnerable to SQL injection. A remote...

Security Bulletin: A vulnerability with GNU Wget affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2018-0494)

Summary A vulnerability with GNU Wget affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data CVE-2018-0494. Please see the details below on how to remediate this issue. Vulnerability Details CVEID:CVE-2018-0494 DESCRIPTION: GNU Wget could allow a remote attacker to bypass securit...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an integer overflow in Perl (CVE-2020-10878).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an integer overflow in Perl, related to the mishandling of a PLregkindOPn == NOTHING situation CVE-2020-10878. This could allow a remote attacker to execute arbitrary code on the system using a...

Security Bulletin: glibc Vulnerability affects Watson Speech Services

Summary A Redhat glibc Vulnerability affecting Watson Speech Services has been fixed in the latest version of IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.3 Vulnerability Details CVEID:CVE-2021-35942 DESCRIPTION: GNU C Library aka glibc could allow a local attacker to obtai...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in cURL libcurl (CVE-2022-22576).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass caused by improper authentication validation in cURL libcurl CVE-2022-22576. cURL libcurl is used as part of the base image included in our service components. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Vim (CVE-2022-1785, CVE-2022-1897, CVE-2022-1927)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to to arbitrary code execution in Vim caused by an out-of-bounds write in function: vimregsubboth CVE-2022-1785, CVE-2022-1897 and a buffer over-read in function: utfptr2char CVE-2022-1927. Vim is used as part o...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to credential exposure in cURL libcurl (CVE-2022-27774)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to credential exposure in cURL libcurl CVE-2022-27774, which could allow an attacker to use this information to launch further attacks against the affected system. The affected component, "same host check" in cU...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL (CVE-2022-0778)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an infinate loop denial of service in OpenSSL, caused by a flaw in the BNmodsqrt function when parsing certificates CVE-2022-0778. OpenSSL is used as part of the base image included in our service components...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information disclosure or denial of service in GNU glibc (CVE-2021-35942).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information disclosure and denial of service in GNU glibc, caused by a flaw when called with an untrusted, crafted pattern in thewordexp function. CVE-2021-35942. GNU glibc is used as part of the base image...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git (CVE-2018-1000021)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git, caused by the failure to validate messages received from a Git server CVE-2018-1000021. Git is included in the base operating system used by IBM Watson Speech. Please read...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to incorrect access control in Golang Go (CVE-2022-23773)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to incorrect access control caused by a fault in cmd/go in Golang Go CVE-2022-23773. Cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. Thi...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-23806)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go, caused by a flaw with the IsOnCurve function which returns true for invalid field elements. CVE-2022-23806. Golang Go is included in some of the operators used in IBM Watson...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-28327).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go, caused by improper input validaiton by the generic P-256 feature in crypto/elliptic CVE-2022-28327. Golang Go is included in some of the operators used in IBM Watson Speech...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in MS Visual Studio (CVE-2021-21300).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to vulnerable to arbitrary code execution in MS Visual Studio , caused by a flaw in the Git for Visual Studio CVE-2021-21300. Git for Visual Studio is used in the base operating system by IBM Watson Speech. Plea...