Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to privilege escalation due to CVE-2021-41617

Summary OpenSSH is part of the base OS modules in all operand images in IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container is not directly vulnerable under standard operations, but custom use of the images may be vulnerable to privilege escalation. This...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2021-3634

Summary libssh is part of the base OS modules in all operand images in IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container is not directly vulnerable under standard operations, but custom use of the images may be vulnerable to arbitrary code execution...

Security Bulletin: IBM App Connect Enterprise Certified Container Operator and IntegrationServer operands may be vulnerable to denial of service due to CVE-2021-44716

Summary IBM App Connect Enterprise Certified Container Operator and IntegrationServer operands may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability CVE-2021-44716. Vulnerability Details CVEID:CVE-2021-44716 DESCRIPTION: Golang Go i...

Security Bulletin: IBM App Connect Enterprise Certified Container Operator and IntegrationServer operands may be vulnerable to denial of service due to CVE-2021-39293

Summary IBM App Connect Enterprise Certified Container Operator and IntegrationServer operands may be vulnerable to denial of service if forced to process a malicious archive stream. This bulletin provides patch information to address the reported vulnerability CVE-2021-39293. Vulnerability Detai...

Security Bulletin: IBM App Connect Enterprise Certified Container Operator may be vulnerable to denial of service due to CVE-2021-38561

Summary Golang Go Text is used by IBM App Connect Enterprise Certified Container Operator internally. The Operator may be vulnerable to denial of service if a Golang panic is triggered. This bulletin provides patch information to address the reported vulnerability CVE-2021-38561. Vulnerability...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer components that use Designer flows may be vulnerable to CVE-2022-1243

Summary Node.js module URI.js is used by IBM App Connect Enterprise Certified Container for processing URIs in Designer flows. IBM App Connect Enterprise Certified Container IntegrationServers that use Designer flows may be vulnerable to CVE-2022-1243. This bulletin provides patch information to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to CVE-2022-0778

Summary OpenSSL is used by IBM App Connect Enterprise Certified Container for certificate creation and verification. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service when processing a malicious certificate. This bulletin provides patch information to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of confidentiality due to CVE-2022-0536

Summary Node.js module follow-redirects is used by IBM App Connect Enterprise Certified Container operands when making network calls in a Node.js process. IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of confidentiality. This bulletin provides patch information...

CVE-2022-26651

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The funcodbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. Th...

Sql injection

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The funcodbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. Th...

CVE-2022-26651

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The funcodbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. Th...

Vulnerabilities fixed in Asterisk

Vulnerabilities have been fixed in Asterisk and Certified Asterisk. These vulnerabilities potentially allow a malicious party to perform an SQL injection attack, issue arbitrary requests or download send arbitrary requests or download larger than allowed files. Asterisk has made updates available...

CVE-2022-26651

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The funcodbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. Th...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to arbitrary code execution due to CVE-2021-23555

Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container by the Box connector in a Designer flow. IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to CVE-2021-23555. This bulletin provides patch information ...

IBM App Connect Enterprise Certified Container拒绝服务漏洞

IBM App Connect Enterprise is an operating system from IBM Corporation. IBM App Connect Enterprise combines the existing industry-trusted IBM Integration Bus technology with IBM App Connect Professional and new cloud-native technology to provide a platform that meets the full integration needs of...

CVE-2022-22404

IBM App Connect Enterprise Certified Container Dashboard UI IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1 may be vulnerable to denial of service due to excessive rate limiting...

CVE-2022-22404

IBM App Connect Enterprise Certified Container Dashboard UI IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1 may be vulnerable to denial of service due to excessive rate limiting...

Design/Logic Flaw

IBM App Connect Enterprise Certified Container Dashboard UI IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1 may be vulnerable to denial of service due to excessive rate limiting...

CVE-2022-22404

The CVE-2022-22404 entry concerns IBM App Connect Enterprise Certified Container Dashboard UI vulnerability in the Dashboard components for versions 1.5, 2.0, 2.1, 3.0 and 3.1, caused by excessive rate limiting that can lead to denial of service. The issue has CVSS v3.0 base score 6.5 (Network, L...

CVE-2022-22404

IBM App Connect Enterprise Certified Container Dashboard UI IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1 may be vulnerable to denial of service due to excessive rate limiting...