Security Bulletin: IBM Cloud Pak for Security is vulnerable to Using Components with Known Vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed the relevant vulnerabilities. Vulnerability Details CVEID:CVE-2022-21721 DESCRIPTION: Next.js is vulnerable to a denial of service, caused by a...

Security Bulletin: A security vulnerability in Node.js nconf affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js nconf affects IBM Cloud Automation Manager Vulnerability Details CVEID:CVE-2022-21803 DESCRIPTION: Node.js nconf module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw when using the memory...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2022-24771 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking the...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2022-24772 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking for...

Security Bulletin: A security vulnerability in GO affects IBM Cloud Automation Manager

Summary A security vulnerability in GO affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2022-28327 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validaiton by the generic P-256 feature in crypto/elliptic. By sending a specially-crafted...

Security Bulletin: A security vulnerability in GO affects IBM Cloud Automation Manager

Summary A security vulnerability in GO affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2022-24921 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation. By using a specially-crafted deeply nested expression, a remote attacker could...

Security Bulletin: A security vulnerability in GO affects IBM Cloud Automation Manager

Summary A security vulnerability in GO affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2021-43565 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an input validation flaw in golang.org/x/crypto's readCipherPacket function. By sending an empty plaintext...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2022-24773 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services. Vulnerability Details CVEID:CVE-2022-24772 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services. Vulnerability Details CVEID:CVE-2022-24771 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature...

Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud App Management

Summary There are vulnerabilities in Mozilla Firefox used by IBM® Cloud App Management. IBM® Cloud App Management has addressed the applicable CVEs in a later version. Vulnerability Details CVEID:CVE-2020-6815 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management

Summary There are vulnerabilities in Node.js used by IBM® Cloud App Management. IBM® Cloud App Management has addressed the applicable CVEs in a later version. Vulnerability Details CVEID:CVE-2019-15604 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by improper certificate...

Security Bulletin: A vulnerability in Oracle Java SE affects IBM Cloud App Management (CVE-2020-2654)

Summary An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. This vulnerability has been addressed in a later version of IBM Clou...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to information disclosure due to its use of Apache Hadoop (CVE-2017-15713)

Summary Vulnerability in Apache Hadoop allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history serv...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to information leakage due to its use of Java (CVE-2022-35550)

Summary Java is used by several components in IBM Cloud Pak for Multicloud Management Monitoring to interact with the operating system and for functional utilities. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to a DoS attack due to its use of Apache Parquet (CVE-2021-41561)

Summary Apache Parquet is used by its spark component in IBM Cloud Pak for Multicloud Management Monitoring in support of the predictive insights function. This vulnerability is limited to a malicous insider with access to the spark component. Vulnerability Details CVEID:CVE-2021-41561 DESCRIPTIO...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is potentially vulnerable to execution of arbitrary code due to its use of Apache Log4j (CVE-2022-23305)

Summary Apache Log4j is used by IBM Cloud Pak for Multicloud Management Monitoring as part of its logging infrastructure. Apache Log4j v1.2 has been removed and replaced by Log4j v2.17.1. Components that use Apache Log4j v1.2 are not exposed outside the cluster and are not configured to use the...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has multiple vulnerabilities associated with the Go runtime (CVE-2021-29923, CVE-2021-31525, CVE-2021-33194, CVE-2021-33195, CVE-2021-33196, CVE-2021-33197, CVE-2021-33198)

Summary The Go runtime is used by several components in IBM Cloud Pak for Multicloud Management Monitoring to interact with the operating system and provide utility functions. Vulnerability Details CVEID:CVE-2021-34558 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by the...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to arbitrary code execution due to its use of Logback (CVE-2021-42550)

Summary Logback is used by IBM Cloud Pak for Multicloud Management Monitoring in its cassandra component to write logs. This vulnerability is limited to a malicious insider who can find and manipulate the logging configuration files. Vulnerability Details CVEID:CVE-2021-42550 DESCRIPTION: Logback...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is potentially vulnerable to execution of arbitrary code due to its use of Apache Log4j (CVE-2022-23302)

Summary Apache Log4j is used by IBM Cloud Pak for Multicloud Management Monitoring as part of its logging infrastructure. Apache Log4j v1.2 has been removed and replaced by Log4j v2.17.1. Components that use Apache Log4j v1.2 are not exposed outside the cluster and are not configured to use the...