Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Bouncy Castle

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Bouncy Castle. Vulnerability Details IBM X-Force ID: 235079 DESCRIPTION: Node.js org.bouncycastle:bcprov-jdk15on module could provide weaker than expected security, caused by the use of a weak key-hash messag...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Ansible

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Ansible. Vulnerability Details CVEID:CVE-2021-4041 DESCRIPTION: Ansible Runner could allow a local authenticated attacker to execute arbitrary code on the system, caused by improper shell escaping of the shel...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in GnuPG [CVE-2022-3515 and CVE-2022-34903]

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of GnuPG. CVE-2022-3515 and CVE-2022-34903 This has been addressed. Vulnerability Details CVEID:CVE-2022-3515 DESCRIPTION: GnuPG Libksba could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in AWS SDK for Java

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of AWS SDK for Java. Vulnerability Details CVEID:CVE-2022-31159 DESCRIPTION: AWS SDK for Java could allow a remote authenticated attacker to traverse directories on the system, caused by a flaw in the...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID:CVE-2022-32222 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions. By attempting to read openssl.cnf from /home/iojs/build/ upon startup, a...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Python. Vulnerability Details CVEID:CVE-2022-0391 DESCRIPTION: Python could provide weaker than expected security, cause by a improper input validation by the urllib.parse module. By sending a specially-craft...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to WebSphere Application Server Liberty identity spoofing (CVE-2022-24476)

Summary Potential vulnerabilities in WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty identity spoofing by an authenticated user using a specially crafted requestCVE-2022-24476 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refe...

Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.8 and earlier

Summary This fix upgrades to Websphere Liberty 22.0.0.10, NodeJs 14.20.1, Jackson 2.14.0-rc1, Protobuf 3.16.3, Apache commons-text 1.10.0 Vulnerability Details CVEID:CVE-2022-35256 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly handle header field...

Security Bulletin: Multiple Vulnerabilities in node.js

Summary Security Vulnerabilities in node.js affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information.. Vulnerability Details CVEID:CVE-2022-35255 DESCRIPTION: Node.js could provide weaker than expected security, caused by the failure to check the return...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to WebSphere Application Server Liberty Denial of Service due to Neko HTML (CVE-2022-24839)

Summary Potential vulnerabilities in WebSphere Application Server Liberty Denial of Service due to Neko HTML CVE-2022-24839 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-24839...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.5. Vulnerability Details CVEID:CVE-2019-20444 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw in the HttpObjectDecoder.java. By sending a specially-crafted request, an attacker cou...

Security Bulletin: A security vulnerability in Node.js moment affects IBM Cloud Pak for Watson AIOps Infrastructure Automation

Summary A security vulnerability in Node.js moment affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Vulnerability Details CVEID:CVE-2022-31129 DESCRIPTION: Moment is vulnerable to a denial of service, caused by inefficient regular expression complexity. By sending a...

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Vulnerability Details CVEID:CVE-2022-21824 DESCRIPTION: Node.js could provide weaker than expected security, caused by an error related to the formatting logic of the console.table functio...

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Vulnerability Details CVEID:CVE-2021-44531 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of URI Subject Alternative Na...

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Vulnerability Details CVEID:CVE-2022-32215 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly handle multi-line Transfer-Encoding headers by t...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java. Vulnerability Details CVEID:CVE-2021-2163 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Hadoop (CVE-2021-25642)

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Hadoop. Vulnerability Details CVEID:CVE-2021-25642 DESCRIPTION: Apache Hadoop could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in PostgreSQL

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of PostgreSQL. Vulnerability Details CVEID:CVE-2022-31197 DESCRIPTION: PostgreSQL is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to PGJDBC implementation of the...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Xalan

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Xalan. Vulnerability Details CVEID:CVE-2022-34169 DESCRIPTION: The Apache Xalan Java XSLT library could allow a remote attacker to execute arbitrary code on the system, caused by an integer truncation...