Security Bulletin: MAS Monitor 8.4, 8.5, and 8.6 log4j

Summary A new vulnerability with log4j has been detected. MAS Monitor uses log4j in all releases and interim fixes are now available for our 8.4, 8.5 and 8.6 releases. More details of the vulnerability are available here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Vulnerability Details...

Security Bulletin: CVE-2021-44228 log4j affects MAS Monitor 8.4, 8.5 and 8.6

Summary A new vulnerability with log4j has been detected. MAS Monitor uses log4j in all releases and interim fixes are now available for our 8.4, 8.5 and 8.6 releases. More details of the vulnerability are available here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Vulnerability Details CVEID...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Pak for Data System 1.0

Summary Apache Log4j used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2022-23305 Vulnerability Details CVEID: CVE-2022-23305 DESCRIPTION: Apache Log4j is vulnerable to SQL injection. A remote attacker could send specially-crafted SQ...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Pak for Data System 1.0

Summary Apache Log4j used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2022-23302 Vulnerability Details CVEID:CVE-2022-23302 DESCRIPTION: Apache Log4j could allow a remote authenticated attacker to execute arbitrary code on the syste...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2022-23648)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd where specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup...

Security Bulletin: A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2021-23555 DESCRIPTION: Node.js vm2 module could allow a remote attacker to execute arbitrary code on the system, caused by a sandbox bypass flaw during generation of a...

Security Bulletin: A security vulnerability in log4j v1.2 affects IBM Cloud Automation Manager

Summary A security vulnerability in log4j v1.2 affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data when the attacker has...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of IBM Websphere Liberty (CVE-2021-35517, CVE-2021-36090)

Summary IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of IBM Websphere Liberty. IBM Websphere Liberty is uses as a middleware server. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service,...

Security Bulletin: Operations Dashboard is vulnerable to denial of service by Go vulnerability CVE-2021-33198

Summary Operations Dashboard is vulnerable to denial of service by Go vulnerability CVE-2021-33198 with details below Vulnerability Details CVEID: CVE-2021-33198 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the SetString and UnmarshalText methods of math/big.Ra...

Security Bulletin: A security vulnerability in Node.js follow-redirects module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js follow-redirects module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2022-0536 DESCRIPTION: Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused by a leakage of the...

Security Bulletin: A security vulnerability in Node.js node-forge module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js node-forge module affects IBM Cloud Automation Manager. Vulnerability Details Third Party Entry: 217313 DESCRIPTION: Nodejs node-forge module could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype...

Security Bulletin: A security vulnerability in golang affects IBM Cloud Automation Manager

Summary A security vulnerability in golang affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2022-23772 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a buffer overflow in the Rat.SetString function in math/big. By sending a specially-crafted request, ...

Security Bulletin: A security vulnerability in golang affects IBM Cloud Automation Manager

Summary A security vulnerability in golang affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-44717 DESCRIPTION: Golang Go could allow a remote attacker to bypass security restrictions, caused by an error in the syscall.ForkExec interface. By causing the erroneous closing...

Security Bulletin: A security vulnerability in Node.js marked module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js marked module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2022-21680 DESCRIPTION: Node.js marked module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in block.def. By sending...

Security Bulletin: A security vulnerability in Node.js marked module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js marked module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2022-21681 DESCRIPTION: Node.js marked module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in inline.reflinkSearch...

Security Bulletin: A security vulnerability in Node.js node-forge module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js node-forge module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2022-0122 DESCRIPTION: Node.js node-forge could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Pak for Network Automation (CVE-2021-44228)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Cloud Pak for Network Automation to provide logging functionality. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker t...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Private (CVE-2021-44832)

Summary There is a vulnerability in the Apache Log4j open source library. The library is used by Elasticsearch, a dependency of IBM Cloud Private, for logging messages to files. This bulletin identifies the security fixes to apply to address the vulnerability CVE-2021-44832. Vulnerability Details...

Security Bulletin: Data masking rules are not enforced when CREATE TABLE AS SELECT statement is executed in IBM Big SQL

Summary A software defect in IBM Big SQL prevents data masking rules to be enforced when a user executes CREATE TABLE AS SELECT … WITH DATA statement. The newly created table contains unmasked data. Vulnerability Details CVEID:CVE-2022-22353 DESCRIPTION: IBM Big SQL could allow an authenticated...

Security Bulletin: Data masking rules are not enforced when CREATE TABLE AS SELECT statement is executed in IBM Data Virtualization on Cloud Pak for Data

Summary There is a defect in IBM Data Virtualization on Cloud Pak for Data where Watson Knowledge Catalog data masking rules will not be enforced when a user executes CREATE TABLE AS SELECT … WITH DATA statement successfully. The newly created table will contain unmasked data. Vulnerability Detai...