Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-3197 )

Summary SSL vulnerabilities were disclosed on January 28, 2016 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2015-3197 DESCRIPTION: OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by an error...

Security Bulletin: Multiple vulnerabilities in SSL affect IBM DataPower Gateways

Summary SSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when parsing DSA privat...

Security Bulletin: IBM DataPower Gateway has released a fixpack in response to the vulnerability known as Spectre.

Summary IBM has released the following fixpack for IBM DataPower Gateways in response to CVE-2017-5753. Vulnerability Details CVEID: CVE-2017-5753 Affected Products and Versions IBM DataPower Gateways appliances, versions 7.1.0.0-7.1.0.21, 7.2.0.0-7.2.0.18, 7.5.0.0-7.5.0.12, 7.5.1.0-7.5.1.11,...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM DataPower Gateway Appliances (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM DataPower Gateway Appliances. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-3193, CVE-2015-3195, CVE-2015-1794)

Summary SSL vulnerabilities were disclosed on December 3rd, 2015. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3193 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the x8664 Montgomery...

Security Bulletin: Vulnerabilities in GSKit affect Security Access Manager for DataPower (CVE-2015-0159, CVE-2015-0138)

Summary GSKit is an IBM component that is used by Security Access Manager components on DataPower. The GSKit that is shipped with Security Access Manager contains several security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. T...

Security Bulletin: Vulnerabilities in SSH affect IBM DataPower Gateways (CVE-2016-10009, CVE-2016-10012)

Summary SSH vulnerabilities were disclosed by the OpenSSH Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-10009 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary code on the system, caused by the loading ...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateway appliances (CVE-2014-3570, CVE-2015-0204)

Summary SSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. IBM DataPower Gateway has addressed the corresponding applicable CVEs. Vulnerability Details CVEID: CVE-2014-35...

Security Bulletin: A vulnerability in GSKit affects IBM DataPower Gateways (CVE-2015-1788)

Summary An OpenSSL denial of service vulnerability disclosed by the OpenSSL Project affects GSKit. IBM DataPower Gateways uses GSKit in certain moduels - namely MQ, ISAM/TAM, JMS. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION:...

Security Bulletin: Vulnerabilities in XML processing affect IBM DataPower Gateways

Summary IBM DataPower Gateways has addressed vulnerabilities in processing certain XML files that could cause a denial of service. Vulnerability Details CVEID: CVE-2015-5312 DESCRIPTION: An unspecified error in Libxml2 related to an entity expansion flaw has an unknown impact and attack vector...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways

Summary SSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2108 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a buffer...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. IBM DataPower Gateway has addressed the corresponding applicable CVEs. Vulnerability Details CVEID: CVE-2015-0287 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Vulnerability in SSL affects IBM DataPower Gateways (CVE-2016-8610)

Summary An SSL vulnerability was disclosed by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-8610 DESCRIPTION: SSL/TLS protocol is vulnerable to a denial of service, caused by an error when processing ALERT packets during a SSL...

Security Bulletin: Certain cookies missing Secure attribute in IBM DataPower Gateways (CVE-2015-7427)

Summary IBM DataPower Gateways has addressed an issue with missing Secure attribute on certain HTTP cookies. Vulnerability Details CVEID: CVE-2015-7427 DESCRIPTION: IBM DataPower Gateways could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag f...

Security Bulletin: Potential side-channel cryptographic vulnerabilities in IBM DataPower Gateway

Summary IBM DataPower Gateway is potentially vulnerable to two side-channel attacks CVE-2018-0495, CVE-2018-12404 Vulnerability Details CVEID: CVE-2018-0495 DESCRIPTION: Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be...

Security Bulletin: Certificates not removed from DataPower ValCred when updating corresponding APIc truststore (CVE-2020-4205)

Summary When a certificate is removed from an APIc TrustStore, the correspsonding DataPower ValCred may not be updated to match. Vulnerability Details CVEID: CVE-2020-4205 DESCRIPTION: IBM DataPower Gateway could allow an authenticated user to bypass security restrictions, and continue to access...

Security Bulletin: Potential TLS vulnerability using Diffie-Hellman TLS ciphersuites in IBM DataPower Gateway (CVE-2020-1968)

Summary IBM has addressed the relevant CVE CVE-2020-1968 Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections which have...

Security Bulletin: Potential exposure of sensitive data in IBM DataPower Gateway (CVE-2020-4203)

Summary IBM DataPower Gateway could permit privileged users to view certain internal directories. IBM has addressed the CVE. Vulnerability Details CVEID: CVE-2020-4203 DESCRIPTION: IBM DataPower Gateway could potentially disclose highly sensitive information to a privileged user due to improper...

Security Bulletin: Denial of Service in IBM DataPower Gateway (CVE-2020-4580)

Summary IBM has addressed the relevant CVE CVE-2020-4580 Vulnerability Details CVEID: CVE-2020-4580 DESCRIPTION: IBM DataPower Gateway could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. CVSS Base score: 7.5 CVSS Tempor...

Security Bulletin: IBM DataPower Gateway is potentially vulnerable to a DoS issue when processing regular expressions (CVE-2017-16231)

Summary IBM has addressed the following CVE: CVE-2017-16231 Vulnerability Details CVEID: CVE-2017-16231 DESCRIPTION: PCRE is vulnerable to a denial of service, caused by a buffer overflow in the match function in pcreexec.c. By persuading a victim to open a specially crafted file, a remote attack...