Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Foundry Migration Runtime (CVE-2021-44228)

Summary There is a vulnerability in the Apache Log4j open source library. The library is used by Cloud Foundry which is a component of IBM Cloud Foundry Migration Runtime. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code...

Security Bulletin: Log4j - CVE-2021-44228 vulnerability affects IBM Cloud Pak for Business Automation(CP4BA) Workflow Process Service

Summary Log4j CVE-2021-44228 also called Log4Shell or LogJam affected the CP4BA Workflow Process Service. Customers are encouraged to take action and apply the fix below. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code ...

Security Bulletin: vulnerability affect IBM Cloud Pak for Business Automation Workflow Process Service (CVE-2021-38900)

Summary IBM Cloud Pak for Business Automaion Workflow Process Service could allow a privileged user to obtain highly sensitive information due to improper access controls. Vulnerability Details CVEID: CVE-2021-38900 DESCRIPTION: IBM Business Automation Workflow could allow a privileged user to...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has patched several open source dependencies

Summary IBM Cloud Pak for Multicloud Management Monitoring has patched several open source dependencies that were inadvertently missed during previous scans. Vulnerability Details CVEID: CVE-2021-21409 DESCRIPTION: Netty is vulnerable to request smuggling, caused by improper validation of request...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to log4j (CVE-2021-44228)

Summary A vulnerability has been identified in Apache Log4j. Automation Assets in IBM Cloud Pak for integration utilizes Log4j CVE-2021-44228. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the...

Security Bulletin: Multiple vulnerabilities in IBM Websphere Application Server affect the IBM Performance Management product

Summary Multiple vulnerabilities in IBM Websphere Application Server - Liberty could allow a remote attacker to exploit them to cause a denial of service condition against services that use Compress' zip package. IBM Performance Management has addressed the applicable CVEs. Vulnerability Details...

Security Bulletin: Operations Dashboard in IBM Cloud Pak for Integration is vulnerable to log4j CVE-2021-44228

Summary Operations Dashboard in IBM Cloud Pak for Integration is vulnerable to log4j CVE-2021-44228 Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Log4j 1.2

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Log4j 1.2. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data wh...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Log4j

Summary Log4j is used by IBM Watson Discovery for IBM Cloud Pak for Data to log system events for diagnostics. This bulletin provides a remediation for the vulnerability, CVE-2021-44228 by upgrading Watson Discovery and thus addressing the exposure to the log4j vulnerability. Vulnerability Detail...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Netty

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Netty. Vulnerability Details CVEID: CVE-2021-37136 DESCRIPTION: Netty netty-codec is vulnerable to a denial of service, caused by not allow size restrictions for decompressed data in the Bzip2Decoder. By...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in TensorFlow

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of TensorFlow. Vulnerability Details CVEID: CVE-2021-37635 DESCRIPTION: TensorFlow could allow a local authenticated attacker to obtain sensitive information, caused by a heap out-of-bounds read flaw in the...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in LibTIFF

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of LibTIFF. Vulnerability Details CVEID: CVE-2020-35522 DESCRIPTION: libtiff is vulnerable to a denial of service, caused by a memory malloc failure in tifpixarlog.c. By persuading a victim to open a...

Security Bulletin: IBM Application Navigator, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a remote attacker exploitation of Apache Log4j (CVE-2021-44228)

Summary IBM Application Navigator, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a remote attacker exploitation of Apache Log4j CVE-2021-44228. The IBM Application Navigator contains a copy of Apache Log4j which is not used by the IBM Application Navigator function. Out o...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2021-41190)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd that allows clients to misinterpret manifest and layer fields. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently...

Security Bulletin: WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a Denial of Service (CVE-2021-38951)

Summary WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a Denial of Service CVE-2021-38951 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Principal Products and...

Security Bulletin: Stack-based Buffer Overflow vulnerability in IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Space Management (CVE-2021-39048)

Summary IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Space Management are vulnerable to a stack-based buffer overflow caused by improper bounds checking. Vulnerability Details CVEID: CVE-2021-39048 DESCRIPTION: IBM Spectrum Protect Client is vulnerable to a stack based...

Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring

Summary There are multiple vulnerabilities in Mozilla Firefox that affect IBM Cloud Pak for Multicloud Management Monitoring. Vulnerability Details CVEID: CVE-2021-29988 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by incorrect style...

Security Bulletin: Vulnerability in IBM Event Streams through Apache Kafka key/password validation (CVE-2021-38153)

Summary Vulnerability in IBM Event Streams through Apache Kafka key/password validation Vulnerability Details CVEID: CVE-2021-38153 DESCRIPTION: Apache Kafka could allow a remote attacker to obtain sensitive information, caused by a timing attack flaw due to the use of "Arrays.equals" to validate...

Security Bulletin: A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-23449 DESCRIPTION: Node.js vm2 module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or...

Security Bulletin: A security vulnerability in Node.js jsonpointer module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js jsonpointer module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-23807 DESCRIPTION: Node.js jsonpointer module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in t...