Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to bypass security restrictions and obtain sensitive information due to multiple vulnerabilities.

Summary IBM HTTP Server powered by Apache for IBM i is vulnerable to bypass security restrictions due to failure to send headers CVE-2022-31813, read unintended memory due to large inputs to aprwrite function CVE-2022-28614, and read buffer beyond bound due to large input to apstrcmpmatch...

Security Bulletin: OpenSSL for IBM i is vulnerable to arbitrary command execution (CVE-2022-2068)

Summary OpenSSL is vulnerable to arbitrary command execution due to improper validation of input by creshash script as described in the vulnerability details section. IBM i has addressed the vulnerability in OpenSSL with a fix as described in the remediation/fixes section. Vulnerability Details...

Security Bulletin: Zlib for IBM i is vulnerable to a denial of service attack due to memory corruption (CVE-2018-25032)

Summary Zlib for IBM i is vulnerable to a denial of service attack due to memory corruption as described in the vulnerability details section. IBM i has addressed the vulnerability in Zlib with a fix as described in the remediation/fixes section. Vulnerability Details CVEID: CVE-2018-25032...

Security Bulletin: OpenSSL for IBM i is vulnerable to command injection due to a flaw in c_rehash script (CVE-2022-1292)

Summary OpenSSL is vulnerable to a command injection due to improper user validation in the crehash script as described in the vulnerability details section. IBM i has addressed the vulnerability in OpenSSL with a fix as described in the remediation/fixes section. Vulnerability Details CVEID:...

Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to HTTP request smuggling and a buffer overflow (CVE-2022-22720, CVE-2022-22721)

Summary IBM HTTP Server powered by Apache for IBM i is vulnerable to HTTP requst smuggling and a buffer overflow attack as described in the vulnerability details section. IBM i has addressed the CVEs by providing fixes to the Apache HTTP Server implementation as described in the Remediation/Fixes...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to denial of service due to gson 217225

Summary IBM Db2 Mirror for i setup and GUI use gson which is vulnerable to denial of service as described in the vulnerability details section. IBM has addressed the vulnerability for IBM Db2 Mirror for i. Vulnerability Details IBM X-Force ID: 217225 DESCRIPTION: Google Gson is vulnerable to a...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to directory traversal due to Moment.js (CVE-2022-24785)

Summary The IBM Db2 Mirror for i GUI uses Chart.js for data presentation and charting features. The version of Chart.js used by IBM Db2 Mirror for i depends upon Moment.js which is vulnerable to CVE-2022-24785 as described in the vulnerability details section. IBM has addressed the vulnerability...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to cross-site scripting due to Angular (220414)

Summary The IBM Db2 Mirror for i GUI uses the Angular web framework. The version of Angular used by IBM Db2 Mirror for i is vulnerable to cross-site scripting as described in the vulnerability details section. IBM has addressed the vulnerability for IBM Db2 Mirror for i by upgrading to Angular...

Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to unauthenticated attacker obtaining sensitive information and other attacks due to multiple vulnerabilities.

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i are vulnerable to unauthorized attacker obtaining sensitive information and other vulnerabilities as described in the vulnerability details section. The vulnerability is fixed by applying a Group PTF as...

Red Alerts subscription service for zSeries

This service provides technical information for IT professionals who maintain zSeries servers. As these support bulletins are released, subscribers receive email containing links to the bulletins. Sign up for free notification of Red Alerts from My Notifications! You can also use the Enhanced...

Security Bulletin: IBM Navigator for i is vulnerable to an SQL injection (CVE-2022-22495)

Summary IBM Navigator for i provides server administration functionality via a robust graphical user interface. IBM Navigator for i is vulnerable to an SQL injection as described in the vulnerability details section. The vulnerabilty is fixed by applying the latest HTTP Server for i group PTF as...

Security Bulletin: IBM i components are vulnerable to data access due to CVE-2022-22481

Summary IBM Navigator for i - heritage version GUI is vulnerable to data access as described in the vulnerability details section. IBM has addressed the vulnerability for IBM Navigator for i - heritage version with a fix as described in the remediation/fixes section. Vulnerability Details CVEID:...

Security Bulletin: Due to use of Apache Log4j, OmniFind Text Search Server for DB2 for i is vulnerable to arbitrary code execution (CVE-2021-4104)

Summary There is a vulnerability in Apache Log4j CVE-2021-4104 as described in the vulnerability details section. Apache Log4j v1 is used by OmniFind Text Search Server for DB2 for i for generating logs and diagnostic traces in some of its components. IBM has addressed the vulnerability in OmniFi...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is affected by arbitrary code execution and other attacks due to multiple vulnerabilities.

Summary Multiple vulnerabilities in IBM WebSphere Application Server allow arbitrary code execution, LDAP injection, unauthorized access, and click hijacking as described in the CVEs listed in the vulnerability details section. IBM WebSphere Application Server Liberty for IBM i has addressed the...

Security Bulletin: IBM HTTP Server (powered by Apache) for i is vulnerable to CVE-2021-44224

Summary IBM HTTP Server powered by Apache for i is vulnerable to the issue described in the vulnerability details section. IBM i has addressed the applicable CVE in the Apache HTTP Server implementation. Vulnerability Details CVEID: CVE-2021-44224 DESCRIPTION: Apache HTTP Server is vulnerable to ...

Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are affected by CVE-2021-2341

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i are affected by the CVE as described in the vulnerability details section. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-2341 DESCRIPTION: An unspecified vulnerability in Jav...

Security Bulletin: The IBM i Extended Dynamic Remote SQL server (EDRSQL) is affected by CVE-2021-39056

Summary The IBM i Extended Dynamic Remote SQL server EDRSQL is vulnerable to the issue described in the vulnerability details section. IBM i has addressed the vulnerability. Vulnerability Details CVEID: CVE-2021-39056 DESCRIPTION: The IBM i Extended Dynamic Remote SQL server EDRSQL could allow a...

Security Bulletin: Vulnerability in Apache Log4j (CVE-2021-44228) affects Power HMC

Summary Log4j is used by IBM Power Hardware Management Console HMC for logging system/application events for diagnostics. This bulletin provides a remediation for the vulnerability, CVE-2021-44228 by upgrading IBM Power Hardware Management Console HMC respective PTF and thus addressing the exposu...

Security Bulletin: IBM Navigator for i is affected by security vulnerability (CVE-2021-38876)

Summary IBM Navigator for i heritage version is vulnerable to the issue described in the vulnerability details section. IBM i has addressed the applicable CVE as described in the remediation/fixes section. Vulnerability Details CVEID: CVE-2021-38876 DESCRIPTION: IBM i is vulnerable to cross-site...

Security Bulletin: BIND for IBM i is affected by CVE-2021-25219

Summary The IBM i DNS Server implementation uses ISC BIND. IBM i has addressed the applicable CVE with a fix. Vulnerability Details CVEID: CVE-2021-25219 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by a flaw in response processing. By abusing a lame cache, an attacker could...