IBM Updates
2716Warning Date
Severity Level
Warning Number
Target Sector
31 May, 2020
● High
2020-1293
All
Description:
IBM has released security updates to address multiple vulnerabilities in the following products:
- ICP - Compare & Comply
- RSAD and RSAD4WS
- 9.5 - 9.5.0.3
- 9.6 - 9.6.1.4
- 9.7 - 9.7.0.2
- IBM Spectrum Conductor
- 2.2.1
- 2.4
- 2.4.1
- 2.3.0
- 2.4.0
- 2.4.1
- IBM Security Identity Governance and Intelligence
- 5.2.6
- IBM UrbanCode Deploy
- 7.0.5.2
- Tivoli Application Dependency Discovery Manager
- 7.3.0.0 - 7.3.0.7
- WebSphere MQ
- 5.3.1
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Denial of service attack (DoS) - remotely.
- Obtain sensitive information.
- Execute arbitrary code.
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-cxf-affects-websphere-application-server-cve-2019-12406-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-edition-quarterly-cpu-jan-2020-includes-oracle-jan-2020-cpu-minus-cve-2020-2585-cve-2020-2654-and-cve-2020-2590/
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-2654-may-affect-ibm-sdk-java-technology-edition-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-java-runtime-affects-ibm-spectrum-conductor-and-ibm-spectrum-conductor-with-spark/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-release-for-ibm-security-identity-governance-and-intelligence-in-response-to-security-vulnerabilities-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-4667-lack-of-built-in-hsts-option-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-open-source-python-affects-ibm-tivoli-application-dependency-discovery-manager-cve-2019-18348/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-for-hpe-nonstop-server-is-affected-by-vulnerability-cve-2020-4352-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-runtime-affect-ibm-spectrum-conductor-and-ibm-spectrum-conductor-with-spark-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-release-for-ibm-security-identity-governance-and-intelligence-in-response-to-security-vulnerabilities-2/