Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities

Summary IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.6.15 used by IBM Cloud Transformation Advisor. IBM Cloud Transformation Advisor has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.6.15 used by IBM Cloud Transformation Advisor. IBM Cloud Transformation Advisor has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.6.15 used by IBM Cloud Transformation Advisor. IBM Cloud Transformation Advisor has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates. Vulnerability Details CVEID:...

Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities

Summary IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could...

Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2017-16086 Vulnerability Details CVEID: CVE-2017-16086 DESCRIPTION: Node.js ua-parser module is vulnerable to a denial of service. By sending a specially crafted UserAgent header, a remote attacker could exploit this...

IBM Cloud Pak for Automation XML External Entity Injection Vulnerability

IBM Cloud Pak for Automation is an enterprise container cloud intelligence automation software platform that supports business users in building and running automation applications using containers on Kubernetes. An XML external entity injection vulnerability exists in IBM Cloud Pak for Automatio...

Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2020-15168 Vulnerability Details CVEID: CVE-2020-15168 DESCRIPTION: Node.js node-fetch module is vulnerable to a denial of service, caused by the failure to honor the size option after following a redirect. By using ...

CVE-2021-20482

IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197504...

Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak for Automation

Summary The vulnerabilities are related to Node.js runtime and to other component specific vulnerabilities. Vulnerability Details CVEID: CVE-2020-8265 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a use-after-free in TLSWrap within the TLS implementation. By writing to a TL...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to Node.js vulnerabilities (CVE-2020-1971, CVE-2020-8265, and CVE-2020-8287)

Summary IBM Cloud Pak for Integration is vulnerable to Node.js vulnerabilities CVE-2020-1971, CVE-2020-8265, and CVE-2020-8287 with details of each below. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to Go vulnerabilities (CVE-2021-3114 and CVE-2021-3115)

Summary IBM Cloud Pak for Integration is vulnerable to Go vulnerabilities CVE-2021-3114 and CVE-2021-3115 with details of each below. Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to Go vulnerabilities (CVE-2020-28851 and CVE-2020-28852)

Summary IBM Cloud Pak for Integration is vulnerable to Go vulnerabilities CVE-2020-28851 and CVE-2020-28852 with details of each below. Vulnerability Details CVEID: CVE-2020-28851 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation while parsing the -u...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2021-21334)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd that could allow containers using the same image to share environment variables CVE-2021-21334. Vulnerability Details CVEID: CVE-2021-21334 In containerd an industry-standard container runtime before...

Security Bulletin: IBM Cloud Pak for Security vulnerable to a stack-based buffer overflow (CVE-2020-27221)

Summary IBM Cloud Pak for Security v 1.6.0.0 and earlier is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. This has been addressed in the most recent release of the product. Vulnerability Details CVEID...

Security Bulletin: WebSphere Application Server in IBM Cloud is vulnerable to a Directory Traversal vulnerability (CVE-2020-5016)

Summary WebSphere Application Server is shipped as a component of IBM WebSphere Application Server in IBM Cloud. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins list...

Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js for IBM Cloud. This product has addressed the applicable CVEs. Node.js Update 4-Jan-2021 and 23-Feb-2021 security releases are available. Vulnerability Details CVEID: CVE-2020-1971...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes security vulnerability (CVE-2020-8554)

Summary Red Hat OpenShift on IBM Cloud is affected by a Kubernetes security vulnerability that could allow a malicious user to intercept traffic from other pods or nodes in the cluster CVE-2020-8554 Vulnerability Details CVEID: CVE-2020-8554 Description: Kubernetes could allow a remote...

Security Bulletin: A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Management

Summary A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Managemen 2.2.0 and previous version Vulnerability Details CVEID: CVE-2020-16250 DESCRIPTION: HashiCorp Vault and Vault Enterprise could allow a remote attacker to bypass security restrictions, cause...

Security Bulletin: A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Management

Summary A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Managemen 2.2.0 and previous version Vulnerability Details CVEID: CVE-2020-12757 DESCRIPTION: HashiCorp Vault and Vault Enterprise could allow a remote attacker to bypass security restrictions, cause...