High Severity
Potential CPU Security Issue
Feb 10, 2018 5:02 pm EST
Categorized: High Severity
Share this post:
On Wednesday, January 3, researchers announced a security vulnerability impacting microprocessors. IBM is working with our clients and industry partners on this issue, which has the potential to affect many types of computing devices from different manufacturers. It’s important to note there are no known cases where this vulnerability has been used maliciously.
Patches will be made available for IBM systems via our normal customer portals. Further details concerning potentially impacted processors in the POWER family can be found here. Per our business as usual process, all information for IBM Z clients can be found at the IBM Z Portal.
IBM Storage appliances are not impacted by this vulnerability. For Storage, further details concerning this vulnerability can be found here.
Additional information will be provided through normal IBM communications channels, including IBM Security Bulletins. Please actively monitor both your IBM Support Portal and the IBM PSIRT Blog.
The most immediate action clients can take to protect themselves is to prevent execution of unauthorized software on any system that handles sensitive data, including adjacent virtual machines.
We will continue to update this blog to include additional information as appropriate.
Security Bulletin: Vulnerability in IBM SDK Java affects IBM Cloud Pak System (CVE-2020-27221)
Nov 26, 2021 7:00 pm EST | Critical Severity
Vulnerability in IBM SDK Java affects IBM Cloud Pak System. OS Image for Red Enterprise Linux shipped with Cloud Pak System addressed this vulnerability. ...read more
Security Bulletin: Vulnerability in jsoup may affect Cúram Social Program Management (CVE-2021-37714)
Nov 25, 2021 7:01 pm EST | High Severity
IBM Cúram Social Program Management uses the jsoup libraries, for which there is a publicly known vulnerability. For this vulnerability jsoup is susceptible to a denial of service attack, caused by improper input validation. ...read more
Security Bulletin: Vulnerability in Apache Log4j may affect Cúram Social Program Management (CVE-2020-9488)
Nov 25, 2021 7:01 pm EST | Low Severity
IBM Cúram Social Program Management uses the Apache Log4j libraries, for which there is a publicly known vulnerability. For this vulnerability, Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appender. ...read more