Security Bulletin: An Eclipse Jetty Denial of Service vulnerability affects IBM Rational Functional Tester / DevOps Test UI

Summary There is a vulnerability in Eclipse Jetty used by Rational Functional Tester RFT / DevOps Test UI Test UI. RFT/Test UI has addressed the applicable CVE CVE-2024-9823. Vulnerability Details CVEID:CVE-2024-9823 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by a fla...

Security Bulletin: Due to the use of Eclipse Jetty, IBM App Connect Professional is vulnerable to bypass security restrictions

Summary Eclipse Jetty is used within IBM App Connect Professional Vulnerability Details CVEID:CVE-2024-6763 DESCRIPTION: Eclipse Jetty could allow a remote attacker to bypass security restrictions, caused by improper validation on the authority segment of a URI in the HttpURI class. By sending a...

Security Bulletin: Due to the use of Eclipse Jetty, IBM App Connect Professional is vulnerable to bypass security restrictions

Summary Eclipse Jetty is used within IBM App Connect Professional Vulnerability Details CVEID:CVE-2024-6763 DESCRIPTION: Eclipse Jetty could allow a remote attacker to bypass security restrictions, caused by improper validation on the authority segment of a URI in the HttpURI class. By sending a...

Security Bulletin: IBM Data Product Hub is affected by several vulnerabilities

Summary IBM Data Product Hub has a dependencies on IBM WebSphere Application Server Liberty, IBM Semeru Runtime, and Node.js elliptic & path-to-regexp modules, which are vulnerable. This bulletin contains information regarding the vulnerabilities and their fixture. Vulnerability Details...

Security Bulletin: Multiple vulnerabilities affect IBM® Semeru Runtime

Summary This bulletin for IBM Semeru Runtime covers all applicable Java SE CVEs published by OpenJDK as part of their October 2024 Vulnerability Advisory, plus CVE-2024-10917 and CVE-2024-9143. For more information please refer to OpenJDK's October 2024 Vulnerability Advisory and the X-Force...

Security Bulletin: There are multiple vulnerabilities in IBM App Connect Enterprise due to IBM Semeru Runtime

Summary There are multiple vulnerabilities in IBM App Connect Enterprise due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2024-21217 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition related to the Serialization...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Eclipse Jetty

Summary Multiple vulnerabilities in Eclipse Jetty that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2024-9823 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by a flaw in the DosFilter feature. By sending specially crafted...

Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition

Summary This bulletin for IBM SDK, Java Technology Edition covers all applicable Java SE CVEs published by Oracle as part of their October 2024 Critical Patch Update, plus CVE-2024-10917. For more information please refer to Oracle's October 2024 CPU Advisory and the X-Force database entries...

IBM Java 7.1 < 7.1.5.24 / 8.0 < 8.0.8.35

The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.24 / 8.0 prior to 8.0.8.35. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update December 2024 advisory. - In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Nov 2024

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Process Mining 1.15.0 IF004 Vulnerability Details CVEID:CVE-2024-38821 DESCRIPTION: VMware Tanzu Spring Security could allow a remote attacker to bypass security...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.17.0 release

Red Hat OpenShift Dev Spaces 3.17 has been released. All containers have been updated to include feature enhancements, bug fixes and CVE fixes. This includes fixes to Critical CVE-2024-21534. Following the Red Hat Product Security standards this update is rated as having a security impact of...

The vulnerability of the HttpURI class in Eclipse Jetty’s server container allows a attacker to perform an SSRF attack.

The vulnerability of the HttpURI class in Eclipse Jetty’s server container is related to improper syntax validation during input processing. Exploiting this vulnerability allows an attacker to perform an SSRF attack remotely...

November Linux Patch Wednesday

November Linux Patch Wednesday. I was happy in October that the number of vulnerabilities was gradually decreasing to an acceptable level, and in November I got a peak again. A total of 803 vulnerabilities. Of these, 567 are in the Linux Kernel. Kind of crazy. 2 vulnerabilities in Chromium with...

The vulnerability of the Eclipse Mosquitto messaging broker, related to buffer overflows in dynamic memory, allows an attacker to gain access to confidential information.

The vulnerability of the Eclipse Mosquitto messaging broker is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential information...

The vulnerability of the Eclipse Mosquitto messaging broker, related to memory reclamation, allows a hacker to trigger a service failure.

The vulnerability of the Eclipse Mosquitto messaging broker is related to repeated memory release. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

Security Bulletin: Several Security Vulnerabilities were discovered in IBM Security Directory Suite

Summary Several Security Vulnerabilities in the IBM Security Directory Integrator and Eclipse Jetty were addressed in the IBM Security Directory Suite. Vulnerability Details CVEID:CVE-2022-32759 DESCRIPTION: IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0...

Security Bulletin: IBM Sterling B2B Integrator is affected by multiple vulnerabilities in Eclipse Jetty

Summary IBM Sterling B2B Integrator is affected by multiple vulnerabilities in Eclipse Jetty Vulnerability Details CVEID:CVE-2023-41900 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to bypass security restrictions, caused by improper authentication validation when using t...

The vulnerability of the Eclipse Glassfish application server relates to the redirection of URLs to an unreliable website, allowing attackers to redirect users to any given URL address.

The vulnerability of the Eclipse Glassfish application server is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a hacker to redirect users to any given URL address...

The vulnerability of the ConsumerPullTransferTokenValidationApiController component in the data-processing and information ecosystem software for Eclipse EDC allows a perpetrator to bypass token expiration checks.

The vulnerability of the ConsumerPullTransferTokenValidationApiController component in the data-processing and information ecosystem of Eclipse EDC is related to authentication procedures’ flaws. Exploiting this vulnerability could allow a malicious actor to bypass token expiration checks...

The vulnerability of the Eclipse Vert.x tool set, related to memory leaks, allows an attacker to disclose protected information or cause service failures.

The vulnerability of the Eclipse Vert.x framework is related to memory leaks. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...