Security Bulletin: IBM MQ is vulnerable to multiple issues within IBM® Runtime Environment Java™ Technology Edition, Versions 7 and 8 (CVE-2021-35603, CVE-2022-21305, CVE-2022-21291, CVE-2021-35550)

Summary Multiple issues were identified with IBM® Runtime Environment Java™ Technology Edition, version 7 that is packaged with IBM MQ 8.0 and version 8 that is packaged with IBM MQ 9.0, 9.1 and 9.2. Vulnerability Details CVEID:CVE-2021-35603 DESCRIPTION: An unspecified vulnerability in Java SE...

Security Bulletin: IBM MQ is affected by multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8

Summary Multiple vulnerabilities were found with IBM® Runtime Environment Java™ Technology Edition, Version 8 which is shipped with IBM MQ and used for Java & JMS client, AMQP, MQTT, MFT & MQIPT functionality. Vulnerability Details CVEID:CVE-2021-35561 DESCRIPTION: An unspecified vulnerability in...

Security Bulletin: IBM MQ is affected by an identity spoofing issue in IBM WebSphere Application Server Liberty (CVE-2022-22476)

Summary An issue was identified in IBM WebSphere Application Server Liberty which IBM MQ ships and uses to supply MQ Console and MQ REST API functionality. Vulnerability Details CVEID:CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty a...

Security Bulletin: A security vulnerability in Ruby on Rails affects IBM Cloud Pak for Multicloud Management Infrastructure Management [CVE-2022-21831]

Summary A security vulnerability in Ruby on Rails affects IBM Cloud Pak for Multicloud Management Infrastructure Management CVE-2022-21831 Vulnerability Details CVEID:CVE-2022-21831 DESCRIPTION: Ruby on Rails Active Storage module could allow a remote attacker to execute arbitrary code on the...

Security Bulletin: IBM Informix Cryptographic Library Updates (CVE-2012-2190, CVE-2012-2191, CVE-2012-2203)

Abstract Multiple security problems exist in the IBM GSKit libraries that IBM Informix and IBM Informix ClientSDK use to provide communications security and other cryptographic functionality. Content CVE ID: CVE-2012-2190 DESCRIPTION: GSKit allows remote attackers to cause a denial of service...

Security Bulletin: InfoSphere Streams is affected by multiple vulnerabilities in the IBM Java JDK (CVE-2013-1500, CVE-2013-2412, CVE-2013-1571)

Abstract The IBM JDK shipped with InfoSphere Streams has security vulnerabilities which can potentially impact InfoSphere Streams. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1500 An unspecified vulnerability in the Java Runtime Environment JRE component allows local users to affect...

Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)

Summary Apache Struts is used by IBM Sterling Order Management as part of its web application framework used for creating Java EE web applications . We recommend upgrading to the latest supported version of Struts that was released as part of the latest FixPack 29. Vulnerability Details...

Security Bulletin: Due to use of IBM WebSphere Application Server Liberty, IBM Tivoli Application Dependency Discovery Manager is vulnerable to Identity Spoofing (CVE-2022-22475 CVE-2022-22476)

Summary IBM WebSphere Application Server Liberty is used by IBM Tivoli Application Dependency Discovery Manager CVE-2022-22475, CVE-2022-22476 Vulnerability Details CVEID:CVE-2022-22475 DESCRIPTION: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable...

Security Bulletin: IBM WebSphere MQ Clients connecting to a Queue Manager could cause a SIGSEGV in the Channel process amqrmppa. (CVE-2018-1374)

Summary A client connecting to a IBM MQ or IBM WebSphere MQ Queue Manager could cause a SIGSEGV in the channel process amqrmppa. Vulnerability Details CVEID: CVE-2018-1374 DESCRIPTION: A IBM WebSphere MQ Client connecting to a Queue Manager could cause a SIGSEGV in the Channel process amqrmppa...

Security Bulletin: IBM MQ Advanced Message Security is vulnerable to an OpenSSL error while parsing an ASN.1 data. (CVE-2018-0739)

Summary IBM MQ have addressed a vulnerability whereby OpenSSL could allow a remote attacker to execute a denial of service attack by sending specially crafted ASN.1 data. OpenSSL is used by IBM MQ Advanced Message Security on the IBM i platform only. Vulnerability Details CVEID: CVE-2018-0739...

Security Bulletin: IBM MQ Advanced Message Security is vulnerable to an OpenSSL Montgomery squaring function propagation flaw (CVE-2017-3736)

Summary IBM MQ and IBM WebSphere MQ are affected by an OpenSSL vulnerability which could allow a remote attacker to obtain sensitive information. This is caused by a carry propagation flaw in the the x8664 Montgomery squaring function bnsqrx8xinternal. OpenSSL is used by IBM MQ Advanced Message...

Security Bulletin: IBM MQ Advanced Message Security is vulnerable to an OpenSSL error while parsing an IPAdressFamily extension in an X.509 certificate. (CVE-2017-3735)

Summary IBM MQ have addressed a vulnerability whereby OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error while parsing an IPAdressFamily extension in an X.509 certificate. OpenSSL is used by IBM MQ Advanced Message Security on the IBM i platform only...

Security Bulletin: IBM MQ and IBM MQ Appliance are vulnerable to a memory leak in pubsub (CVE-2017-1786)

Summary IBM MQ queue managers handling publish subscribe messaging might leak memory in response to specific application requests, resulting in a loss of service. Vulnerability Details CVEID: CVE-2017-1786 DESCRIPTION: IBM MQ under special circumstances could allow an authenticated user to consum...

Security Bulletin: IBM PureData System for Analytics vulnerable to unauthorized access and modification of local files (CVE 2013-5374)

Summary It is possible to read and modify local files via unknown vectors. Exploitation requires authentication and specific permissions. Confidentiality and integrity may be partially impacted and availability may be fully impacted. Vulnerability Details CVE ID:CVE-2013-5374 CVSS Base Score: 7.5...

Security Bulletin: Vulnerabilities in vCenter affect IBM Cloud Pak System (CVE-2021-21980, CVE-2021-22049 )

Summary Vulnerabilities have beein found in VMware vCenter. vCenter is shipped with Cloud Pak System. Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2021-21980 DESCRIPTION: VMware vCenter Server could allow a remote attacker to obtain sensitive information,...

Security Bulletin: IBM Workload Scheduler is potentially vulnerable to denial of service due to CVE-2022-0778 affecting OpenSSL component

Summary OpenSSL vulnerability CVE-2022-0778 has been disclosed by the OpenSSL Project. OpenSSL is used by IBM Workload Schedulerfor secure communications between the components. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw i...

Security Bulletin: IBM MQ Appliance is affected by follow-redirects vulnerabilities (CVE-2022-0155 and CVE-2022-0536)

Summary IBM MQ Appliance has resolved follow-redirects vulnerabilities. Vulnerability Details CVEID: CVE-2022-0155 DESCRIPTION: follow-redirects could allow a remote attacker to obtain sensitive information, caused by an unauthorized actor. By sending a specially-crafted request, a remote...

Security Bulletin: IBM MQ Appliance is affected by an identity spoofing vulnerability (CVE-2022-22475)

Summary IBM MQ Appliance has resolved an identity spoofing vulnerability. Vulnerability Details CVEID: CVE-2022-22475 DESCRIPTION: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID:...

Security Bulletin: IBM MQ Appliance is affected by a zlib vulnerability (CVE-2018-25032)

Summary IBM MQ Appliance has resolved a zlib vulnerability. Vulnerability Details CVEID: CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By using many distant matches, a remote attacker could exploit this vulnerability...

Security Bulletin: IBM MQ Appliance is affected by a Java vulnerability (CVE-2021-35550)

Summary IBM MQ Appliance has resolved a Java vulnerability. Vulnerability Details CVEID: CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality...