Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in LibTIFF

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of LibTIFF. Vulnerability Details CVEID:CVE-2022-0561 DESCRIPTION: LibTIFF is vulnerable to a denial of service, caused by a NULL pointer dereference in memcpy function in TIFFFetchStripThing in...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in LibTIFF

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of LibTIFF. Vulnerability Details CVEID:CVE-2022-22844 DESCRIPTION: LibTIFF is vulnerable to a denial of service, caused by an out-of-bounds read flaw in the TIFFmemcpy function in tifunix.c. By...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.6.1 Vulnerability Details CVEID:CVE-2022-40674 DESCRIPTION: libexpat could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in the doContent function in xmlparse.c. A...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Watson Explorer and Watson Explorer Content Analytics Studio (CVE-2022-21626)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by Watson Explorer and Watson Explorer Content Analytics Studio. Watson Explorer and Watson Explorer Content Analytics Studio have addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21626...

Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix

Summary A vulnerability in Apache CXF affecting WebSphere Liberty JAX-WS has been fixed in Liberty: 20.0.0.5. This fix is included in ICP Watson Text to Speech, Speech to Text v1.1.2 GA: 6/19/20. Vulnerability Details CVEID:CVE-2019-17573 DESCRIPTION: Apache CXF is vulnerable to cross-site...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Perl (CVE-2018-18311).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow, caused by an integer overflow in the Perlmysetenv function of Perl CVE-2018-18311. Perl is included in some of the operators used in IBM Watson Speech. Please read the details fo...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU glibc (CVE-2020-1751).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU glibc, caused by an out-of-bounds write when handling signal trampolines on PowerPC CVE-2020-1751. GNU glibc is used as part of the base image included in our service components...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a SQL injection in PostgreSQL (CVE-2022-31197)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a SQL injection in PostgreSQL , caused by an vulnerability in the PGJDBC implementation of the java.sql.ResultRow.refreshRow method, CVE-2022-31197. PostgreSQL is a database used with a number of our Speech...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3...

Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix

Summary A WebSphere liberty vulnerability to a DOS has been fixed in Liberty 20.0.0.5. This fix is included in ICP WatsonTexttoSpeech, Speech to Text v1.1.2 6/19/20. Vulnerability Details CVEID:CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in libssh, caused by improper bounds checking.(CVE-2021-3634).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in libssh, caused by improper bounds checking CVE-2021-3634. Libssh, included in RedHat, is used in the base operating system by IBM Watson Speech. Please read the details for...

Security Bulletin: A Vulnerability with jackson-databind before 2.13.0 affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

Summary A Vulnerability with jackson-databind before 2.13.0 affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data. Please see below for details on how to remediate this issue. Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is vulnerable to a...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in GNU C Library (CVE-2019-19126)

Summary Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in GNU C Library, caused by failing to ignore the LDPREFERMAP32BITEXEC environment variable during program execution. CVE-2019-19126. GNU C Library is used as...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in urllib3 (CVE-2021-33503).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in urllib3, caused by a regular expression denial of service ReDoS flaw due to catastrophic backtracking CVE-2021-33503. This could be exploited by a remote attacker to cause a denial of...

Security Bulletin: Information disclosure vulnerability in WebSphere Application Server affects IBM Watson Text to Speech and Speech to Text (IBM Watson™ Speech Services 1.1)

Summary There is a potential information disclosure vulnerability, where a Stack is displayed in IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2019-4441 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an HTTP request smuggling issue in Twisted (CVE-2022-24801).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTTP request smuggling in Twisted CVE-2022-24801. By using header manipulation, an attacker could exploit this vulnerability to poison a web-cache, perform an XSS attack. Twisted is used as part of our speech...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by a buffer overflow in NumPy (CVE-2021-41496)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to to a denial of service in NumPy, caused by a buffer overflow in the arrayfrompyobj function of fortranobject.c. CVE-2021-41496. NumPy is used as part of our speech runtime component. Please read the details f...

Security Bulletin: A Google Guava vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2018-10237)

Summary A Google Guava vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data CVE-2018-10237. Please see below for information on how to remediate this issue. Vulnerability Details CVEID:CVE-2018-10237 DESCRIPTION: Google Guava is vulnerable to a denial of service,...

Security Bulletin: A vulnerability with Guava affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2020-8908)

Summary A vulnerability with Guava affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data CVE-2020-8908. Please see below for details on how to remediate this issue. Vulnerability Details CVEID:CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated privileges in Linux Kernel (CVE-2022-27666).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated privileges caused by a buffer overflow in Linux Kernel CVE-2022-27666. Linux Kernel is used as part of the base image included in our service components. Please read the details for remediation below...