IBM Support

Security Bulletin: IBM InfoSphere Information Server containers are vulnerable to privilege escalation

Security Bulletin


A privilege escalation vulnerability was addressed in IBM InfoSphere Information Server.

Vulnerability Details

CVEID: CVE-2019-4185
DESCRIPTION: IBM InfoSphere Information Server containers are vulnerable to privilege escalation due to an insecurely configured component.
CVSS Base Score: 8.3
CVSS Temporal Score: See for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

The following products, running on all supported platforms, are affected:
        IBM InfoSphere Information Server: version 11.7.1
        IBM InfoSphere Information Server on Cloud: version 11.7.1



Workarounds and Mitigations

Perform the following steps to secure your environment:

1. List your kube-system namespace
     > kubectl get deployments -n kube-system


2. List the pods in your kube-system namespace
      > kubectl get deployments -n kube-system


3. Delete the tiller pod
     >  kubectl delete deployment tiller-deploy --namespace=kube-system

4. Verify that the tiller pod was deleted by examining the output of command
     > kubectl get deployments -n kube-system

    Verify that helm is working by executing the following command:
     > helm list

    The output should contain the list of deployed services.
    However, if the following error message is displayed:
         Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"

         Execute the following command:
         > kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

        After 10 to 20 seconds, again check the output of "helm list" as indicated above.

After making the above changes, if at a later point in time you need to install a patch, you must deploy the tiller pod before installing the patch. Use the following steps:

1. Deploy tiller
     > /usr/local/bin/helm init

2. Verify that the tiller POD is created by executing the command
     >  kubectl get deployments -n kube-system

     You should see tiller-deploy listed in the output.
3. Install the patch
4. Repeat the steps listed above to again secure your environment.

Get Notified about Future Security Bulletins



Change History

06 May 2019: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.


According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Internal Use Only


Document Location


[{"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Product":{"code":"SSZJPZ","label":"InfoSphere Information Server"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"11.7.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
06 May 2019