Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in the Cryptography package for Python [CVE-2023-49083]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in the Cryptography package for Python, caused by a NULL pointer dereference when loading PKCS7 certificates CVE-2023-49083. The Cryptography package for Python is used in our Speech Service...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to SQL injection in PostgreSQL JDBC Driver [CVE-2024-1597]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to SQL injection in PostgreSQL JDBC Driver, through the use of the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL CVE-2024-1597. Postgres is...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-websocket-9.0.83.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-websocket-9.0.83.jar Vulnerability Details CVEID:CVE-2024-23672 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an incomplete cleanup flaw. By sending specially crafted...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in python-requests [CVE-2023-32681]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in python-requests, caused by the leaking of Proxy-Authorization headers to destination servers during redirects to an HTTPS origin CVE-2023-32681. python-requests is used as a...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in urllib3 [CVE-2023-45803]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in urllib3, caused by a flaw with not remove the HTTP request body when an HTTP redirect response using status 303 CVE-2023-45803. urllib3 is used as a component of our Speech runtimes...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected by information exposure in urllib3 [CVE-2023-43804]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected by potential sensitive information exposure in urllib3, caused by a flaw with cookie request header not stripped during cross-origin redirects. CVE-2023-43804. urllib3 is used as a component of our Speech runtimes...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in Open Container Initiative runc [CVE-2024-21626]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in Open Container Initiative runc, caused by an internal file descriptor leak CVE-2024-21626. Open Container Initiative runc is part of the gcc utils used by our service runtimes. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow in rsyslog [ CVE-2022-24903]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in rsyslog, caused by improper bounds checking by the TCP syslog server receiver components CVE-2022-24903. Rsyslog is used as a component of our Speech runtimes. This...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pypdf2-3.0.1-py3-none-any.whl

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of pypdf2-3.0.1-py3-none-any.whl Vulnerability Details CVEID:CVE-2023-36464 DESCRIPTION: py-pdf pypdfis vulnerable to a denial of service, caused by an infinite loop if parsecontentstream is executed. By...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Ansible - CVE-2023-5115

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Ansible - CVE-2023-5115 Vulnerability Details CVEID:CVE-2023-5115 DESCRIPTION: Ansible could allow a remote attacker to traverse directories on the system, caused by improper validation of user...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in urllib3-1.26.16-py2.py3-none-any.whl

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of urllib3-1.26.16-py2.py3-none-any.whl Vulnerability Details CVEID:CVE-2023-43804 DESCRIPTION: urllib3 could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw wit...

Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.15 and earlier

Summary This fix upgrades to Node.js 18.19.1. Node.js is used by all IBM Answer Retrieval for Watson Discovery user interfaces. There are two categories of vulnerabilities addressed. The first allows remote attackers to gain access to the system, bypassing security restrictions. The second makes...

The vulnerability of cloud-based data storage software for IBM Watson CP4D Data Stores lies in the lack of encryption measures for protected data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of cloud-based data storage software for IBM Watson CP4D Data Stores lies in the lack of encryption measures for protected data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Security Bulletin: Multiple security vulnerabilities in IBM SDK, Java Technology Edition affects IBM OpenPages

Summary IBM® SDK, Java™ Technology Edition is shipped as a supporting program of IBM OpenPages. Information about a security vulnerability affecting IBM SDK, Java Technology Edition has been published in multiple security bulletins. These products have addressed the applicable CVEs. For a complet...

The vulnerability of cloud-based data storage software for IBM Watson CP4D Data Stores lies in HTTP request processing errors, which allow attackers to compromise data integrity.

The vulnerability of cloud-based data storage software from IBM Watson CP4D Data Stores relates to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of data...

IBM Watson CloudPak for Data Data Stores Information Disclosure Vulnerability

IBM Watson CloudPak for Data Data Stores is a data and artificial intelligence platform from International Business Machines IBM. An information disclosure vulnerability exists in IBM Watson CloudPak for Data Data Stores version 4.6.0, which stems from allowing web pages to be stored locally and ...

CVE-2023-26282

IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the system. IBM X-Force ID: 248415...

CVE-2023-26282

IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the system. IBM X-Force ID: 248415...

Design/Logic Flaw

IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the system. IBM X-Force ID: 248415...