Security Bulletin: Vulnerability in OpenSSL affects IBM Cloud Pak System (CVE-2019-1552)

Dec 3, 2019 7:00 pm EST | Low Severity

CVEID:   CVE-2019-1552 DESCRIPTION:   OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be '/usr/local'. However, mingw programs are Windows programs, and as such, find themselves looking at sub-directories of 'C:/usr/local', which may be world writable, which enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows targets, including Visual C builds. However, some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).CVSS Base score: 2.9CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/164498 for the current score.CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) ...read more

Security Bulletin: OpenSSL as used by IBM QRadar Network Packet Capture is vulnerable to a timing side channel attack (CVE-2018-0734)

Nov 26, 2019 7:00 pm EST | Low Severity

CVEID:   CVE-2018-0734 DESCRIPTION:   The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).CVSS Base score: 3.7CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/152085 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) ...read more

Security Bulletin: Information disclosure vulnerability in IBM Tivoli Netcool Impact (CVE-2019-4570)

Nov 21, 2019 7:00 pm EST | Low Severity

CVEID:   CVE-2019-4570 DESCRIPTION:   CVSS Base score: 3.7CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166720 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) ...read more

Security Bulletin: Log Analysis is vulnerable to a client side scripting attack due to missing HTTPOnly and Secure attribute in the cookie

Nov 21, 2019 7:00 pm EST | Low Severity

CVEID:   CVE-2019-4214 DESCRIPTION:   CVSS Base score: 3.7CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159185 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) ...read more

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products

Nov 14, 2019 7:00 pm EST | Low Severity

CVEID:   CVE-2019-2422 DESCRIPTION:   Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).CVSS Base score: 3.1CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/155741 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) CVEID:   CVE-2019-2449 DESCRIPTION:   Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). The supported version that is affected is Java SE: 8u192. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).CVSS Base score: 3.1CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/155766 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) CVEID:   CVE-2019-2426 DESCRIPTION:   Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).CVSS Base score: 3.7CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/155744 for the current score.CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID:   CVE-2018-11212 DESCRIPTION:   An issue was discovered in libjpeg 9a. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.CVSS Base score: 3.3CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/143429 for the current score.CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) ...read more

IBM Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Missing Cookie Secure Attribute vulnerability

Oct 25, 2019 9:03 am EST | Low Severity

IBM Security Guardium Big Data Intelligence (SonarG) has addressed the following vulnerability. CVE(s): CVE-2019-4330 Affected product(s) and affected version(s): Affected IBM Security Guardium Big Data Intelligence (SonarG) Affected Versions IBM Security Guardium Big Data Intelligence (SonarG) 4.0 Refer to the following reference URLs for remediation and additional vulnerability details:Source Bulletin: https://www.ibm.com/support/pages/node/1096384X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/161210 ...read more

IBM Security Bulletin: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition is affected by ASoC vulnerability (CVE-2019-4394)

Oct 24, 2019 9:02 am EST | Low Severity

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise has addressed the ASoC vulnerability. CVE(s): CVE-2019-4394 Affected product(s) and affected version(s): IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5, 2.5.0.1, 2.5.0.2, 2.5.0.3, 2.5.0.4, 2.5.0.5, 2.5.0.6, 2.5.0.7, 2.5.0.8, 2.5.0.9, 2.4, 2.4.0.1, 2.4.0.2, 2.4.0.3, 2.4.0.4, 2.4.0.5 Refer to the following reference URLs for remediation and additional vulnerability ...read more

IBM Security Bulletin: IBM Maximo Anywhere does not have device root detection. (CVE-2019-4265)

Oct 9, 2019 9:01 am EST | Low Severity

IBM Maximo Anywhere does not have device root detection which could result in an attacker gaining sensitive information about the device. CVE(s): CVE-2019-4265 Affected product(s) and affected version(s): Affected IBM Maximo Anywhere Affected Versions IBM Maximo Anywhere 7.6.2 IBM Maximo Anywhere 7.6.3 IBM Maximo Anywhere 7.6.1 IBM Maximo Anywhere 7.6.0 Refer to the following reference ...read more

IBM Security Bulletin: Daeja ViewONE Virtual may expose internal IP addresses (CVE-2019-4246)

Sep 30, 2019 9:01 am EST | Low Severity

During certain operation Daeja ViewONE transmits the internal IP address to the client. CVE(s): CVE-2019-4246 Affected product(s) and affected version(s): Daeja ViewONE Virtual 5.0 – 5.0.6 Refer to the following reference URLs for remediation and additional vulnerability details:Source Bulletin: https://www.ibm.com/support/pages/node/884380X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/159521 ...read more