CVE-2023-26024 IBM Planning Analytics on Cloud Pak for Data information disclosure

IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication. IBM X-Force ID: 247898...

PT-2023-20433 · Ibm · Ibm Planning Analytics On Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics on Cloud Pak for Data version 4.0 Description: The issue is caused by insecure network communication, which could allow an attacker on a shared network to obtain sensitive information. Recommendations: For IBM Planning...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Python

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Python. Vulnerability Details CVEID:CVE-2023-40217 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by a race condition in the SSLSocket module. When the...

Security Bulletin: A vulnerability in Microsoft Azure Identity SDK may affect IBM Robotic Process Automation for Cloud Pak and result in arbitrary code execution. (CVE-2023-36414).

Summary There is a vulnerability in Microsoft Azure Identity SDK used by IBM Robotic Process Automation as part of API configuration. An attacker could exploit this vulnerability to execute arbitrary code on the system, caused by an integer overflow. CVE-2020-36414. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in OpenSSL [CVE-2023-2975]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in OpenSSL, caused by AES-SIV cipher implementation CVE-2023-2975. OpenSSL is included as part of the packages used by our Speech Services runtimes. This vulnerabilitiy has been...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python [CVE-2022-48564]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python, caused by a flaw in the readints function in plistlib.py CVE-2022-48564. Python is used in our Speech Service runtimes. This vulnerabilitiy has been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information disclosure in python-requests [CVE-2023-32681]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information disclosure in python-requests, caused by the leaking of Proxy-Authorization headers to destination servers during redirects to an HTTPS origin CVE-2023-32681. Python-requests is used in...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information disclosure in Apple macOS Big Sur [CVE-2023-32360]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information disclosure in Apple macOS Big Sur, caused by an authentication issue in the CUPS component CVE-2023-32360. Some of the libraries used by our Speech microservices are affected by this...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in Python Cryptographic Authority [CVE-2023-38325]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in Python Cryptographic Authority, caused by an encoding mismatch regarding critical options with OpenSSH CVE-2023-38325. Python Cryptographic Authority is used for cryptography in our our...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in Apache Tomcat [CVE-2023-34981]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in Apache Tomcat, caused by a flaw when a response did not have any HTTP headers set CVE-2023-34981. Apache Tomcat is a component used by our Speech microservices. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Hutool [ CVE-2022-45688]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Hutool, caused by stack-based buffer overflow CVE-2022-45688. Hutool is a component used by our Speech microservices. This vulnerabilitiy has been addressed. Please read the details for...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues. IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data has migrated to a new base image for the Operators used by our Speech Services. The following vulnerabilities...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data 4.8.0 has addressed security vulnerabilities

Summary IBM Cognos Dashboards on Cloud Pak for Data 4.8.0 resolves vulnerabilities reported in the Node.js August 2023 Security Releases as well as vulnerabilities in Apache POI, Apache Shiro, Apache Commons Net, Apache Commons Codec, Eclipse Jetty, Netty, Python and Snappy-Java.Please refer to t...

Security Bulletin: IBM Cognos Analytics Cartridge for IBM Cloud Pak for Data 4.8.0 has addressed a security vulnerability (CVE-2023-4863)

Summary IBM Cognos Analytics Cartridge for IBM Cloud Pak for Data is affected but not considered vulnerable to a heap-buffer-overlfow in libwebp CVE-2023-4863. Vulnerability Details CVEID:CVE-2023-4863 DESCRIPTION: Google Chrome is vulnerable to a heap-based buffer overflow, caused by improper...

Security Bulletin: IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.8.0 has addressed security vulnerabilities

Summary IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.8.0 resolves vulnerabilities in Golang Go, Gin-Gonic Gin and libp2p go-libp2p. A vulnerability where sensitive information could be shared due to insecure network communication has also been addressed. Please refer to the table...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in RabbitMQ Java Client

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of RabbitMQ Java Client. Vulnerability Details CVEID: CVE-2023-46120 DESCRIPTION: RabbitMQ Java Client is vulnerable to a denial of service, caused by no message size limit in maxBodyLebgth. By sending...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Apache ZooKeeper

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Apache ZooKeeper. Vulnerability Details CVEID: CVE-2023-44981 DESCRIPTION: Apache ZooKeeper could allow a remote attacker to bypass security restrictions, caused by a flaw when SASL Quorum Peer...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Nginx

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Nginx. Vulnerability Details CVEID: CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Babel

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Babel. Vulnerability Details CVEID: CVE-2023-45133 DESCRIPTION: Babel could allow a local attacker to execute arbitrary code on the system, caused by a flaw in the path.evaluateor path.evaluateTruth...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in PostCSS

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of PostCSS. Vulnerability Details CVEID: CVE-2023-44270 DESCRIPTION: PostCSS could allow a remote attacker to bypass security restrictions, caused by improper input validaiton. By using a specially...