Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go CVE-2022-23772

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go CVE-2022-23772 with details below Vulnerability Details CVEID: CVE-2022-23772 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a buffer overflow in...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to attack under error due to Go CVE-2022-23773

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to attack under error due to Go CVE-2022-23773 with details below Vulnerability Details CVEID: CVE-2022-23773 DESCRIPTION: An unspecified error with not treating branches with semantic-version names a...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go CVE-2021-44716

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go CVE-2021-44716 with details below Vulnerability Details CVEID: CVE-2021-44716 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an uncontrolled memo...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Watson Assistant for IBM Cloud Pak for Data is affected but not vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to ...

Security Bulletin: Multiple Vulnerabilities in Intel Processors affect Cloud Pak System

Summary Multiple Vulnerabilities in Intel Processors affect Cloud Pak System. Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2020-8700 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused...

Security Bulletin: Vulnerabilitiìy identified in IBM DB2 that is shipped as component and pattern type or pType with Cloud Pak System and Cloud Pak System Software Suite. Cloud Pak System addressed response with new DB2 pType

Summary Vulnerabilitiìy identified in IBM DB2. DB2 is shipped as pattern type or pType with Cloud Pak System and supporting product with Cloud Pak System Software Suite. Cloud Pak System addressed vulnerabilty. Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and...

CVE-2021-29859

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

CVE-2021-29859

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

CVE-2021-29859

CVE-2021-29859 affects IBM Cloud Pak for Business Automation, specifically IBM ICP4A - User Management System component in versions 21.0.3 (21.0.3-IF008), 21.0.2 (21.0.2-IF009), and 21.0.1 (21.0.1-IF007) and earlier. The issue arises from insufficient input/validation and logout handling, allowin...

CVE-2021-29859

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

Security Bulletin: Vulnerability in Intel Xeon affects IBM Cloud Pak System (CVE-2021-0144)

Summary A vulnerability found in Intel Xeon affects IBM Cloud Pak System. IBM Cloud Pak System addressed this vulnerability. Vulnerability Details CVEID: CVE-2021-0144 DESCRIPTION: Intel Xeon and Intel Core products could allow a local authenticated attacker to gain elevated privileges on the...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for April 2022

Summary In addition to many updates of open source packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.2-IF010 and 21.0.3-IF008. Vulnerability Details CVEID: CVE-2021-39038 DESCRIPTION: IBM WebSphere Application Server 9.0 and IBM WebSphe...

CVE-2021-29859

IBM ICP4A - User Management System Component IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007 could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information...

Security Bulletin: Operations Dashboard in Cloud Pak for Integration is affected by Spring4Shell CVE-2022-22965

Summary Operations Dashboard in Cloud Pak for Integration is affected by Spring4Shell CVE-2022-22965 with details below Vulnerability Details CVEID: CVE-2022-22965 DESCRIPTION: Spring Framework could allow a remote attacker to execute arbitrary code on the system, caused by the improper handling ...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache POI

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache POI. Vulnerability Details CVEID: CVE-2022-26336 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by an out of memory exception flaw in the HMEF package. By persuading a victim to...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Kotlin

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Kotlin. Vulnerability Details CVEID: CVE-2022-24329 DESCRIPTION: JetBrains Kotlin could provide weaker than expected security, caused by failing to lock dependencies for Multiplatform Gradle Projects. A remot...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in PostgreSQL

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java.PostgreSQL JDBC Driver. The vulnerability is more difficult to expolit since it is an internal component protected from direct access. Vulnerability Details IBM X-Force ID: 220313 DESCRIPTION: PostgreSQL...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java. Vulnerability Details CVEID: CVE-2022-21365 DESCRIPTION: An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled in IBM Cloud Pak for Applications, is vulnerable to spoofing attacks and clickjacking due to swagger-ui (CVE-2018-25031, CVE-2021-46708)

Summary IBM WebSphere Application Server Liberty, which is bundled in IBM Cloud Pak for Applications, is vulnerable to spoofing attacks and clickjacking due to swagger-ui CVE-2018-25031, CVE-2021-46708 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Vulnerabilities fixed in IBM Db, Db2 on OpenShift and Cloud Pak for Data

Several vulnerabilities have been fixed in IBM Db2 On Openshift and IBM Db2 and Db2 Warehouse on Cloud Pak for Data. These vulnerabilities allow an attacker to execute arbitrary code execute arbitrary code or cause a denial-of-service DoS. For the vulnerabilities with attributes CVE-2021-33196 an...