Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22135, CVE-2021-22137)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22135, CVE-2021-22137. Vulnerability Details CVEID: CVE-2021-22135...

Security Bulletin: Vulnerability in Netty affects IBM Cloud Private (CVE-2021-21409)

Summary There is a vulnerability in the Netty open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Netty vulnerability CVE-2021-21409. Vulnerability Details CVEID: CVE-2021-21409 DESCRIPTION: Netty is vulnerable...

Security Bulletin: Vulnerability in Netty affects IBM Cloud Private (CVE-2021-21295)

Summary There is a vulnerability in the Netty open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Netty vulnerability CVE-2021-21295. Vulnerability Details CVEID: CVE-2021-21295 DESCRIPTION: Netty is vulnerable...

Security Bulletin: Vulnerability in Netty affects IBM Cloud Private (CVE-2021-21290)

Summary There is a vulnerability in the Netty open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Netty vulnerability CVE-2021-21290. Vulnerability Details CVEID: CVE-2021-21290 DESCRIPTION: Netty could allow a...

Security Bulletin: A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-23449 DESCRIPTION: Node.js vm2 module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or...

Security Bulletin: IBM Cloud Private is affected by an issue with runc used by Docker

Summary IBM Cloud Private is affected by an issue with runc used by Docker. The vulnerability allows a malicious container to overwrite the host runc binary and thus gain root-level code execution on the host Vulnerability Details CVEID: CVE-2019-5736 DESCRIPTION: Runc could allow a local attacke...

Security Bulletin: IBM Cloud Private is vulnerable to MongoDB vulnerabilities (CVE-2020-7924)

Summary IBM Cloud Private is vulnerable to MongoDB vulnerabilities Vulnerability Details CVEID: CVE-2020-7924 DESCRIPTION: MongoDB Database Tools could allow a remote attacker to bypass security restrictions, caused by a flaw in the usage of specific command line parameter. By sending a...

Security Bulletin: IBM Cloud Private is vulnerable to Dojo vulnerabilities (CVE-2020-5258)

Summary IBM Cloud Private is vulnerable to Dojo vulnerabilities Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this...

Security Bulletin: IBM Cloud Private is vulnerable to Apache vulnerabilities (CVE-2021-26296)

Summary IBM Cloud Private is vulnerable to Apache vulnerabilities Vulnerability Details CVEID: CVE-2021-26296 DESCRIPTION: Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL vulnerabilities (CVE-2021-3449, CVE-2021-3450)

Summary IBM Cloud Private is vulnerable to OpenSSL vulnerabilities Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signaturealgorithms processing. By sending a specially crafted renegotiation ClientHello...

Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2021-27919, CVE-2021-27918)

Summary IBM Cloud Private is vulnerable to a Go vulnerability Vulnerability Details CVEID: CVE-2021-27919 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the Reader.Open API when use a ZIP archive containing files start with “../”. By persuading a victim to open a...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL and Node.js vulnerabilities (CVE-2021-23840, CVE-2021-22884, CVE-2021-22883)

Summary IBM Cloud Private is vulnerable to OpenSSL and Node.js vulnerabilities Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could exploit this...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities (CVE-2020-28500)

Summary IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities Vulnerability Details CVEID: CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS in the toNumber, trim and trimEnd functions. By...

Security Bulletin: IBM Cloud Private is vulnerable to Elastic vulnerabilities (CVE-2020-7021 )

Summary IBM Cloud Private is vulnerable to Elastic vulnerabilities Vulnerability Details CVEID: CVE-2020-7021 DESCRIPTION: Elasticsearch could allow a local authenticated attacker to obtain sensitive information, caused by an error when audit logging and the emitrequestbody option is enabled. By...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL vulnerabilities (CVE-2021-23839, CVE-2021-23840, CVE-2021-23841)

Summary IBM Cloud Private is vulnerable to OpenSSL vulnerabilities Vulnerability Details CVEID: CVE-2021-23839 DESCRIPTION: OpenSSL could provide weaker than expected security, caused by incorrect SSLv2 rollback protection that allows for the inversion of the logic during a padding check. If the...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities (CVE-2021-23337)

Summary IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection flaw in the template. By...

Security Bulletin: IBM Cloud Private is vulnerable to Java vulnerabilities (CVE-2020-2773)

Summary IBM Cloud Private is vulnerable to Java vulnerabilities Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low...

Security Bulletin: IBM Cloud Private is vulnerable to Helm vulnerabilities ( CVE-2021-21303)

Summary IBM Cloud Private is vulnerable to Helm vulnerabilities Vulnerability Details CVEID: CVE-2021-21303 DESCRIPTION: Helm could allow a local authenticated attacker to bypass security restrictions, caused by the failure to sanitized multiple fields in various .yaml files. By sending a...

Security Bulletin: IBM Cloud Private is vulnerable to Docker vulnerabilities (CVE-2021-21285, CVE-2021-21284)

Summary IBM Cloud Private is vulnerable to Docker vulnerabilities Vulnerability Details CVEID: CVE-2021-21285 DESCRIPTION: Docker is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to pull a specially-crafted Docker image, a remote attacker could...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL and Node.js vulnerabilities (CVE-2020-1971, CVE-2020-8287, CVE-2020-8265)

Summary IBM Cloud Private is vulnerable to OpenSSL and Node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker could...