Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2023-24537).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go, caused by an infinite loop due to integer overflow when calling any of the Parse functions. CVE-2023-24537. Golang Go is included in the operators used by our Speech Services...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2023-24536).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go, caused by a flaw during multipart form parsing. CVE-2023-24536. Golang Go is included in the operators used by our Speech Services. This vulnerabilitiy has been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in OpenSSL (CVE-2022-4304)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in OpenSSL, caused by a timing-based side channel in the RSA Decryption implementation CVE-2022-4304. OpenSSL is included in the Base OS image used by our Speech Services.. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL (CVE-2023-0215)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL, caused by a use-after-free error related to the incorrect handling of streaming ASN.1 data by the BIOnewNDEF function CVE-2023-0215. OpenSSL is included in the Base OS image us...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL (CVE-2022-4450)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL, caused by a double-free error related to the improper handling of specific PEM data by the PEMreadbioex function CVE-2022-4450. OpenSSL is included in the Base OS image used by...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Go (CVE-2023-24539).

Summary Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Go, due to a weakness in a template containing multiple actions separated by a '/' character CVE-2023-24539. Go is included in the operators used by our Speech Services...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Golang Go [CVE-2023-24538]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Golang Go, caused by the failure to properly consider backticks as Javascript string delimiters. Golang Go is included in the operators used by our Speech Services. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Go [CVE-2023-24540]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Go, due to a weakness in a template containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029". Go is included in the operators used by our Speech Services...

Security Bulletin: Watson CP4D Data Stores is vulnerable to Golang Go denial of service vulnerability ( CVE-2022-41724)

Summary Potential Golang Go denial of service vulnerability CVE-2022-41724 has been identified that may affect Watson CP4D Data Stores Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-41724 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Bouncy Castle

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Bouncy Castle. Vulnerability Details CVEID:CVE-2023-33201 DESCRIPTION: The Bouncy Castle Crypto Package For Java bc-java could allow a remote attacker to obtain sensitive information, caused by not...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Java

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Java. Vulnerability Details CVEID:CVE-2023-21930 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the JSSE component could allow an...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by multiple vulnerabilities in Golang Go

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Golang Go. The below vulnerabilities have been addresssed. Vulnerability Details CVEID:CVE-2023-24534 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an memory exhaustion in t...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Python

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Python. Vulnerability Details CVEID:CVE-2023-24329 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by a flaw in the urllib.parse component. By sending a...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID:CVE-2022-25869 DESCRIPTION: Node.js angular module is vulnerable to cross-site scripting, caused by improper validation of user-supplied input when caching pages...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Angular

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Angular. Vulnerability Details CVEID:CVE-2023-26117 DESCRIPTION: AngularJS is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the $resource service...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - OpenSSL

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - OpenSSL Vulnerability Details CVEID:CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker could exploit thi...

Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data

Summary This bulletin addresses multiple vulnerabilities in Data Virtualization on IBM Cloud Pak for Data. Note that Data Virtualization is rebranded to Watson Query starting in IBM Cloud Pak for Data version 4.6. Vulnerability Details CVEID:CVE-2022-37598 DESCRIPTION: Node.js UglifyJS module cou...

IBM Planning Analytics Encryption Problem Vulnerability (CNVD-2023-68783)

IBM Planning Analytics is a suite of business planning analytics solutions from International Business Machines IBM. The solution supports automated execution of processes such as business planning, budgeting and analysis. Planning Analytics Cartridge for Cloud Pak for Data version v4.0 suffers...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to VMware Tanzu Spring Framework denial of service vulnerabilitiy [CVE-2023-20863]

Summary Potential VMware Tanzu Spring Framework denial of service vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-20863 Vulnerability Details...

CVE-2023-26023

Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896...