Security Bulletin: Multiple vulnerabilities in VMware affect IBM Cloud Pak System

Summary Multiple vulnerabilities have been identified in VMware, a supporting product shipped with IBM Cloud Pak System. Vulnerabilities in VMware vSphere Client HTML5 for VMware vCenter plugins in vRealize Operations Environment, not used in Cloud Pak Systems, but for VMware vulnerabile vCenter...

Security Bulletin: IBM Event Streams is affected by potential data integrity issue (CVE-2020-25649)

Summary IBM Event Streams is potentially vulnerable to a data integrity issue Vulnerability Details CVEID: CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly. A remote attacker could exploit th...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud Pak for Automation

Summary The vulnerabilities are related to Node.js and its modules. Vulnerability Details CVEID: CVE-2021-32804 DESCRIPTION: Node.js tar module could allow a local attacker to traverse directories on the system, caused by insufficient absolute path sanitization. An attacker could use a...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in jsoup

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of jsoup. Vulnerability Details CVEID: CVE-2021-37714 DESCRIPTION: jsoup is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted input, a remote attacker could...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Commons Compress

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Commons Compress. Vulnerability Details CVEID: CVE-2021-35515 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an infinite loop flaw in the construction of the list ...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Kotlin

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Kotlin. Vulnerability Details CVEID: CVE-2020-29582 DESCRIPTION: JetBrains Kotlin could allow a local authenticated attacker to obtain sensitive information, caused by an insecure permission flaw when creatin...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python aiohttp

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Python aiohttp. Vulnerability Details CVEID: CVE-2021-21330 DESCRIPTION: AIOHTTP could allow a remote attacker to conduct phishing attacks, caused by a bug in the aiohttp.webmiddlewares.normalizepathmiddlewar...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python cryptography

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Python cryptography, an open source software. The vulnerability is difficult to expolit since it is an internal component protected from direct access. Vulnerability Details CVEID: CVE-2020-36242 DESCRIPTION:...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Ratpack

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Ratpack, an open source software. These vulnerabilities are difficult to expolit since it is an internal component protected from direct access. Vulnerability Details CVEID: CVE-2021-29479 DESCRIPTION: Ratpac...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache PDFBox

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache PDFBox. Vulnerability Details CVEID: CVE-2021-31811 DESCRIPTION: Apache PDFBox is vulnerable to a denial of service, caused by an out-of-memory exception while loading a file. By persuading a victim to...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of XStream. Vulnerability Details CVEID: CVE-2021-39139 DESCRIPTION: XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Go. Vulnerability Details CVEID: CVE-2021-33196 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the NewReader and OpenReader functions in archive/zip. By persuading a victim t...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Nginx

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Nginx. Vulnerability Details CVEID: CVE-2021-23017 DESCRIPTION: NGINX could allow a remote attacker to execute arbitrary code on the system, caused by an off-by-one error in ngxresolvercopy while processing D...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Commons IO

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Commons IO. Vulnerability Details CVEID: CVE-2021-29425 DESCRIPTION: Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID: CVE-2021-32804 DESCRIPTION: Node.js tar module could allow a local attacker to traverse directories on the system, caused by insufficient absolute path sanitization. An...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Netty

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Netty. Vulnerability Details CVEID: CVE-2021-21290 DESCRIPTION: Netty could allow a local authenticated attacker to obtain sensitive information, caused by an insecure temp file in Unix-like systems. By sendi...

CVE-2021-29894

IBM Cloud Pak for Security CP4S 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207320...

CVE-2021-20578

IBM Cloud Pak for Security CP4S 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282...

CVE-2021-29894

IBM Cloud Pak for Security CP4S 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207320...