Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to data information exposure in cURL libcurl (CVE-2022-27776)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to data information exposure in cURL libcurl CVE-2022-27776, which could allow an attacker to obtain authentication or cookie header information. cURL libcurl is used as part of the base image included in our...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by a buffer overflow in NumPy (CVE-2021-41496)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to to a denial of service in NumPy, caused by a buffer overflow in the arrayfrompyobj function of fortranobject.c. CVE-2021-41496. NumPy is used as part of our speech runtime component. Please read the details f...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to injection attacks in Ansible (CVE-2021-3583).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to attacks in Ansible, caused by template injection in the user's controller CVE-2021-3583. Attackers could exploit this vulnerability to execute arbitrary commands on the system. Ansible is included in some of...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in urllib3 (CVE-2021-33503).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in urllib3, caused by a regular expression denial of service ReDoS flaw due to catastrophic backtracking CVE-2021-33503. This could be exploited by a remote attacker to cause a denial of...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a potential issue in jackson-databind - fasterxml-jackson (217968)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a potential issue in jackson-databind - fasterxml-jackson217968. This Apache library is used by one of our Speech Service components. Please see below for remediation of this vulnerability. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Vim (CVE-2022-1785, CVE-2022-1897, CVE-2022-1927)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to to arbitrary code execution in Vim caused by an out-of-bounds write in function: vimregsubboth CVE-2022-1785, CVE-2022-1897 and a buffer over-read in function: utfptr2char CVE-2022-1927. Vim is used as part o...

Security Bulletin: A vulnerability in Golang Go affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-29923)

Summary A vulnerability in Golang Go before 1.17 affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data. CVE-2021-29923 Please see below for details on how to remediate this issue. Vulnerability Details CVEID:CVE-2021-29923 DESCRIPTION: Golang Go could allow a remote attacker to...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Vim (CVE-2022-1621)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a heap-based buffer overflow in Vim CVE-2022-1621 caused by improper bounds checking in the vimstrncpy findword component. Vim is used as part of the base image included in our service components. Please read...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a stack-based buffer overflow in GNU C Library (CVE-2022-23218)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a stack-based buffer overflow in GNU C Library CVE-2022-23218. This is included as part of the base-image used in our Speech-to-Text and Text-to-Speech service components. Please see below for details on how ...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in Apache Tomcat (CVE-2022-34305)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in Apache Tomcat, which risks exposure of cookie-based authentication credentials. CVE-2022-34305. Apache Tomcat is used as a component in some of our TTS speech service images. Please re...

Security Bulletin: ICP Speech to Text, Text to Speech Oracle Java Vulnerability Fix

Summary An Oracle Java vulnerability has been fixed by a Redhat patch https://access.redhat.com/errata/RHSA-2020:0202, included in ICP Watson Text to Speech, Speech to Text v1.1.2 6/19/20. Vulnerability Details CVEID:CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to th...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in libexpat (CVE-2022-25314).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution caused by a buffer overflow in libexpat CVE-2022-25314. Libexpat is used as part of the base image included in our service components. Please read the details for remediation below...

Security Bulletin: A vulnerability in Apache Tomcat affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

Summary A vulnerability in Apache Tomcat affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data. Please see below for details on how to remediate this issue. Vulnerability Details CVEID:CVE-2022-23181 DESCRIPTION: Apache Tomcat could allow a local authenticated attacker to gain...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information disclosure or denial of service in OpenSSL (CVE-2021-3712)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information disclosure or denial of service in OpenSSL, caused by an out-of-bounds read when processing ASN.1 strings CVE-2021-3712. OpenSSL is used as part of the base image included in our service component...

Security Bulletin: A vulnerability with Guava affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2020-8908)

Summary A vulnerability with Guava affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data CVE-2020-8908. Please see below for details on how to remediate this issue. Vulnerability Details CVEID:CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass...

Security Bulletin: IBM WebSphere Application Server Vulnerability Affects Watson Speech Services

Summary An IBM WebSphere Application Server Liberty Vulnerability affecting Watson Speech Services has been fixed in the latest version of IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.3 Vulnerability Details CVEID:CVE-2021-29842 DESCRIPTION: IBM WebSphere Application Server...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU C Library ( CVE-2020-10029)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU C Library, caused by a stack-based overflow during range reduction CVE-2020-10029. GNU C Library is used as part of the base image included in our service components. Please read th...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a cross-configuration attack against OpenPGP (CVE-2021-40528)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a cross-configuration attack against OpenPGP due to a flaw in GnuPG Libgcrypt. CVE-2021-40528. GnuPG Libgcrypt is used as part of the base image included in our service components. Please read the details for...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow and underflow in GNU C Library (CVE-2021-3999)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer overflow and underflow in GNU C Library CVE-2021-3999. This is included as part of the base-image used in our Speech-to-Text and Text-to-Speech service components. Please see below for details on how...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated privileges in Linux Kernel (CVE-2022-27666).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated privileges caused by a buffer overflow in Linux Kernel CVE-2022-27666. Linux Kernel is used as part of the base image included in our service components. Please read the details for remediation below...