Security Bulletin: Rational Build Forge Security Advisory for Apache HTTPD, Apache Tomcat and OpenSSL Upgrade

Summary Apache HTTPD, Apache Tomcat and OpenSSL have security vulnerabilities that allows a remote attacker to exploit the application. Respective security vulnerabilities are discussed in detail in the subsequent sections. Vulnerability Details This section includes the vulnerability details tha...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2016-8610, CVE-2017-6056, CVE-2017-5647, CVE-2017-5648)

Summary Apache Tomcat and OpenSSL have security vulnerabilities that enables an attacker to exploit the application. Respective security vulnerabilities are discussed in detail in the subsequent sections. Vulnerability Details This section includes the vulnerability details that affect the Ration...

Security Bulletin: OpenSSL and OpenVPN vulnerabilities affect IBM Rational Team Concert (CVE-2016-2183, CVE-2016-6329)

Summary OpenSSL and OpenVPN vulnerabilities affect IBM Rational Team Concert. OpenSSL and OpenVPN are used by Rational BuildForge Agent shipped with IBM Rational Team Concert. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Rational Build Forge (CVE-2015-2625, CVE-2015-1931, CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7sr9fp10,6sr16fp7 and 5sr16fp13 that is used by IBM Rational Build Forge. These issues were disclosed as part of the IBM Java SDK updates in July and October 2015. Vulnerability Details CVEID: CVE-2015-2625...

Security Bulletin:Multiple vulnerabilities in IBM Java SDK affect Rational Build Forge (CVE-2015-0488, CVE-2015-2808, CVE-2015-1916, CVE-2015-0204)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 SR8, 6 SR16-FP3, 5.0 SR16 that is used by Rational Build Forge. These issues were disclosed as part of the IBM Java SDK updates in April 2015. Vulnerability Details CVEID: CVE-2015-0488 DESCRIPTION: An...

Security Bulletin: Rational Build Forge affected by Apache Tomcat vulnerability (CVE-2014-0227)

Summary The Apache Tomcat server used in Rational Build Forge is vulnerable to an attack using request smuggling. Vulnerability Details CVE ID: CVE-2014-0227 Description: Apache Tomcat is vulnerable to HTTP request smuggling. A remote attacker could send a specially-crafted request in a malformed...

Security Bulletin: Vulnerability in RC4 stream cipher affects Build Forge (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Build Forge. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier...

Security Bulletin: Vulnerability in IBM Java SDK affects Build Forge (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® SDK Java™ Technology Edition, Version JDK7sr8, JDK6sr16fp2 that is used by Build Forge. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM SSL/TLS...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Build Forge (CVE-2014-6457)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 1.5, 1.6, 1.7 that is used by IBM Rational Build Forge. These issues were disclosed as part of the IBM Java SDK updates in October 2014. Vulnerability Details CVEID: CVE-2014-6457 Description: An unspecified...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2014-0075, CVE-2014-0099)

Summary Apache Tomcat has security vulnerabilities that can lead to a denial of service DOS attack or obtain sensitive information. To avoid this issue in IBM Rational Build Forge, you should use the latest version Apache Tomcat Server which contains the fix for these problems Vulnerability Detai...

Security Bulletin:Build Forge is affected by the following OpenSSL vulnerabilities (CVE-2014-0224)

Summary Security vulnerabilities which impact IBM Rational Build Forge have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link fo...

Security Bulletin: Rational Build Forge is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. These vulnerabilities affect IBM Rational Build Forge 8.0 and 8.0.0.1. Fixes for the vulnerabilities have been added to the Rational Build Forge 8.0.0.1 iFix1 release. If https and SSL are not enabled, Build Forge 8.0 and 8.0.0.1 a...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2014-0098)

Summary Apache HTTP Server has a security vulnerability that can lead to a denial of service DOS attack. To avoid this issue in IBM Rational Build Forge, you should use the latest version Apache HTTP Server which contains the fix for this problem. Vulnerability Details | Subscribe to My...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2013-4286)

Summary IBM Rational Build Forge is shipped with an Apache Tomcat. Apache Tomcat has released a patch that contains security vulnerability fixes and BuildForge is affected. These fixes have been added to the Rational Build Forge 7.1.3.5 iFix2 and 8.0.0.2 release. Vulnerability Details | Subscribe...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2013-0169)

Summary SSL, TLS and DTLS Plaintext Recovery Attack CVE-2013-0169 Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--- CVEID: CVE-2013-0169 Description: A...

Security Bulletin: IBM Rational Build Forge Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Summary Java API Documentation contains a frame injection vulnerability. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--- CVEID: CVE-2013-1571...

Security Bulletin: Multiple vulnerabilities in IBM Rational Build Forge (CVE-2012-3213, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, C

Summary IBM Rational Build Forge is shipped with an IBM Java that is based on Oracle Java. Oracle has released critical patch updates CPUs January 13, February 1 and February 19 that contain security vulnerability fixes and IBM Java is affected. These fixes have been added to the Rational Build...

Security Bulletin: IBM Rational Build Forge Java (CVE-2012-3216, CVE-2012-5077, CVE-2012-5073, CVE-2012-5074, CVE-2012-5083, CVE-2012-5072, CVE-2012-1531, CVE-2012-5081, CVE-2012-5069, CVE-2012-5079, CVE-2012-5088)

Summary Rational Build Forge is shipped with an IBM Java that is based on Oracle Java. Oracle has released a critical patch update CPU that contains security vulnerability fixes and IBM Java is affected. These fixes have been added to the Rational Build Forge 8.0 release. Vulnerability Details |...

CVE-2016-10555

Since "algorithm" isn't enforced in jwt.decodein jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key...

A few words about Gartner’s “Magic Quadrant for Application Security Testing” 2018

February and March are the hot months for marketing reports. I already wrote about IDC and Forrester reports about Vulnerability Management-related markets. And this Monday, March 19, Gartner released new "Magic Quadrant for Application Security Testing". You can buy it on the official website fo...