Security Bulletin: IBM MQ Blockchain bridge dependencies are vulnerable to an issue in Apache Log4j (CVE-2021-45046)

Summary A Remote Code Execution issue was identified within the Log4j fix for CVE-2021-44228 that is used by Fabric Gateway to provide logging functionality. Fabric Gateway is used by the IBM MQ blockchain bridge component of IBM MQ to provide connection capability between IBM MQ queue managers a...

Security Bulletin: IBM MQ is vulnerable to multiple Jetty vulnerabilities (CVE-2021-34428, CVE-2021-34429, CVE-2021-28169)

Summary Multiple issues were identified in Eclipse Jetty that IBM MQ Explorer uses and is affected by. Vulnerability Details CVEID: CVE-2021-34428 DESCRIPTION: Eclipse Jetty could allow a physical attacker to bypass security restrictions, caused by a session ID is not invalidated flaw when an...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-2341 DESCRIPTION: An unspecified vulnerability in Java SE related to the Networking component cou...

Security Bulletin: Cross Site Scripting when uploading a file might affect IBM Business Automation Workflow - CVE-2021-38883

Summary IBM Business Automation Workflow may be vulnerable to a cross site scripting attack when uploading a file. Vulnerability Details CVEID: CVE-2021-38883 DESCRIPTION: IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Security Bulletin: IBM MQ Appliance is vulnerable to a denial of service attack (CVE-2021-38875)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2021-38875 DESCRIPTION: IBM MQ is vulnerable to a denial of service attack caused by an error processing messages. CVSS Base score: 6.5 CVSS Temporal Score: See:...

Security Bulletin: IBM MQ Appliance is affected by a code injection vulnerability (CVE-2021-38967)

Summary IBM MQ Appliance has resolved a code injection vulnerability. Vulnerability Details CVEID: CVE-2021-38967 DESCRIPTION: IBM MQ Appliance could allow a local privileged user to inject and execute malicious code. CVSS Base score: 8.2 CVSS Temporal Score: See:...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2021-38958)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2021-38958 DESCRIPTION: IBM MQ Appliance is affected by a denial of service attack caused by a concurrency issue. CVSS Base score: 5.1 CVSS Temporal Score: See:...

Security Bulletin: IBM MQ Appliance is affected by a disclosure of sensitive information vulnerability (CVE-2021-39000)

Summary IBM MQ Appliance has resolved a disclosure of sensitive information vulnerability. Vulnerability Details CVEID: CVE-2021-39000 DESCRIPTION: IBM MQ could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. CVSS Base score: 5.9 CVSS...

Security Bulletin: IBM MQ Appliance is affected by a sensitive information disclosure vulnerability (CVE-2021-38999)

Summary IBM MQ Appliance has resolved a sensitive information disclosure vulnerability. Vulnerability Details CVEID: CVE-2021-38999 DESCRIPTION: IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. CVSS Base score: 5.1 CVSS...

Security Bulletin: IBM MQ is vulnerable to a denial of service attack caused by an error processing messages. (CVE-2021-38875)

Summary An issue was identified with IBM MQ message processing code that could allow an authenticated attacker with authority to connect to the queue manager and put messages to execute a denial of service attack against the queue manager with a malformed message. Vulnerability Details CVEID:...

Security Bulletin: IBM MQ Java/JMS clients can inadvertently display cleartext credentials via diagnostic logs (CVE-2021-38949)

Summary An issue was idenitifed in IBM MQ Java and JMS clients where they could display clear text credentials in diagnostics log files automatically generated during system crashes. Vulnerability Details CVEID: CVE-2021-38949 DESCRIPTION: IBM MQ stores user credentials in plain clear text which...

Security Bulletin: IBM MQ is vulnerable to an issue in Eclipse Jetty (CVE-2021-28165)

Summary An issue was identified in Eclipse Jetty that affects IBM MQ. Eclipse Jetty is used within the MQ Explorer, MQ Salesforce Bridge and MQ Blockchain Bridge components. Vulnerability Details CVEID: CVE-2021-28165 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by...

Security Bulletin: IBM MQ Appliance vulnerable to a denial of service attack (CVE-2021-29843)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2021-29843 DESCRIPTION: IBM MQ is vulnerable to a denial of service attack caused by an issue processing message properties. CVSS Base score: 5.3 CVSS Temporal Score: See:...

Security Bulletin: Information disclosure vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-29753

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to an information disclosure attack. Vulnerability Details CVEID: CVE-2021-29753 DESCRIPTION: IBM Business Automation Workflow transmits or stores authentication credentials, but it uses an insecure method th...

Security Bulletin: IBM MQ is vulnerable to an error within Eclipse Jetty (CVE-2020-27216)

Summary An issue was found in Eclipse Jetty that is shipped with the MQ Explorer component of IBM MQ. Vulnerability Details CVEID: CVE-2020-27216 DESCRIPTION: Eclipse Jetty could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition in the...

Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server Liberty (CVE-2021-33517, CVE-2021-36090)

Summary There are multiple vulnerabilities in the Apache Commons Compress library that is used by WebSphere Application Server Liberty. This has been addressed. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out ...

Security Bulletin: CVE-2020-1971 vulnerability in OpenSSL may affect IBM Workload Scheduler

Summary OpenSSL vulnerability CVE-2020-1971 has been disclosed by the OpenSSL Project. OpenSSL is used by IBM Workload Scheduler. IBM Workload Scheduler has addressed the CVE Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL...

Security Bulletin: Multiple vulnerabilities in OpenSSL may affect IBM Workload Scheduler

Summary OpenSSL vulnerabilities CVE-2021-23840, and CVE-2021-23841 have been disclosed by the OpenSSL Project. OpenSSL is used by IBM Workload Scheduler. IBM Workload Scheduler has addressed the CVE Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of...

Security Bulletin: Multiple vulnerabilities in OpenSSL may affect IBM Workload Scheduler

Summary OpenSSL vulnerabilities CVE-2021-3449 and CVE-2021-3450 have been disclosed by the OpenSSL Project. OpenSSL is used by IBM Workload Scheduler. IBM Workload Scheduler has addressed the CVE Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service,...

Security Bulletin: Stack overflow via TIS_CODESET environment variable in IBM Workload Scheduler

Summary Stack overflow via TISCODESET environment variable in IBM Workload Scheduler chkhltst program on Linux, Unix. Vulnerability Details CVEID: CVE-2021-20349 DESCRIPTION: IBM Tivoli Workload Scheduler is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local...