Security Bulletin: IBM Cloud Pak for Applications is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-44832)

Summary Multiple vulnerabilities in Apache Log4j affect IBM WebSphere Application Server which is bundled with IBM Cloud Pak for Applications CVE-2021-45105 and CVE-2021-44832. The fix addresses the vulnerabilities by removing Apache Log4j. Vulnerability Details Refer to the security bulletins...

Security Bulletin: Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server and IBM WebSphere Application Server Liberty which are bundled as part of IBM Cloud Pak for Applications(CVE-2021-4104, CVE-2021-45046)

Summary Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server and IBM WebSphere Application Server Liberty CVE-2021-4104, CVE-2021-45046. Both the IBM WebSphere Application Server and IBM WebSphere Application Server Liberty products are bundled within IBM Cloud Pak...

Security Bulletin: Multiple vulnerabilities in Apache log4j affect IBM WebSphere Application Server which is bundled with IBM Cloud Pak for Applications(CVE-2021-45105, CVE-2021-44832)

Summary Multiple vulnerabilities in Apache log4j affect IBM WebSphere Application Server CVE-2021-45105, CVE-2021-44832. IBM WebSphere Application Server is bundled with IBM Cloud Pak for Applications. There is a vulnerability in the Apache log4j library used by IBM WebSphere Application Server...

Security Bulletin: IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Log4j for CVE-2021-44228

Summary IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Log4j for CVE-2021-44228. Log4j is used by various microservices either directly or indirectly through dependent open source software for logging messages to files. Vulnerability Details CVEID: CVE-2021-4422...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22144)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22144. Vulnerability Details CVEID: CVE-2021-22144 DESCRIPTION:...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22138)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22138. Vulnerability Details CVEID: CVE-2021-22138 DESCRIPTION:...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22138)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22138. Vulnerability Details CVEID: CVE-2021-22138 DESCRIPTION:...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22135, CVE-2021-22137)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22135, CVE-2021-22137. Vulnerability Details CVEID: CVE-2021-22135...

Security Bulletin: Vulnerability in Netty affects IBM Cloud Private (CVE-2021-21409)

Summary There is a vulnerability in the Netty open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Netty vulnerability CVE-2021-21409. Vulnerability Details CVEID: CVE-2021-21409 DESCRIPTION: Netty is vulnerable...

Security Bulletin: Vulnerability in Netty affects IBM Cloud Private (CVE-2021-21295)

Summary There is a vulnerability in the Netty open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Netty vulnerability CVE-2021-21295. Vulnerability Details CVEID: CVE-2021-21295 DESCRIPTION: Netty is vulnerable...

Security Bulletin: Vulnerability in Netty affects IBM Cloud Private (CVE-2021-21290)

Summary There is a vulnerability in the Netty open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Netty vulnerability CVE-2021-21290. Vulnerability Details CVEID: CVE-2021-21290 DESCRIPTION: Netty could allow a...

Unspecified Vulnerability in IBM Cloud Pak for Security (CNVD-2021-102385)

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A security vulnerability exists in IBM Cloud Pak for Security CP4S that stems from...

Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC.

Summary Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC. Vulnerability Details CVEID: CVE-2021-34558 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by the failure to properly assert that the type of public key in an...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2021-38951)

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerabilities have been identified in WebSphere Application Server and the information about their fixes are published in security bulletins. Vulnerability Details Refer to the...

Security Bulletin: Vulnerability in Apache Log4j (CVE-2021-44228) may affect IBM Watson Assistant for IBM Cloud Pak for Data

Summary A potential vulnerability CVE-2021-44228 has been identified related to Apache Log4j that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Several components of IBM Watson Assistant for IBM Cloud Pak for Data use Log4j to log diagnostic data unrelated to customer input. Refer t...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Spectrum Scale (CVE-2021-44228)

Summary A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This library is used by the Graphical User Interface GUI of IBM Spectrum Scale for logging. This vulnerability may affect IBM Spectrum Scale. Vulnerability Details CVEID: CVE-2021-44228...

Information disclosure

IBM Cloud Pak for Security CP4S 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651...

Security Bulletin: IBM WebSphere Hybrid Edition is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary IBM Cloud Transformation Advisor, which is bundled with IBM WebSphere Hybrid Edition, is affected by Apache Log4j vulnerability CVE-2021-44228. Log4j is used by IBM Cloud Transformation Advisor for generating logs in some components and tools. This bulletin provides a remediation for the...

Security Bulletin: IBM Cloud Pak for Applications is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary Security Bulletin: IBM Cloud Transformation Advisor, which is bundled with IBM Cloud Pak for Applications, is affected by Apache Log4j vulnerability CVE-2021-44228. Log4j is used by IBM Cloud Transformation Advisor for generating logs in some components and tools. This bulletin provides a...

Security Bulletin: IBM Cloud Pak for Applications is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is exposed to a vulnerability in Apache Log4j CVE-2021-44228 Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system,...