IBM Updates
2894Warning Date
Severity Level
Warning Number
Target Sector
2 August, 2020
● Medium
2020-1583
All
Description:
IBM has released security updates to address vulnerabilities in the following products:
- IBM Cognos Analytics
- 11.1
- 11.0 (versions prior to 11.0.13 FP2)
- IBM Cloud Private VM Quickstarter
- 3.0
- 3.1
- ITNM
- 4.2.0
- IBM i2 Analyst's Notebook
- 9.2.1
- 9.2.2
- AIX
- 7.1
- 7.2
- VIOS
- 2.2
- 3.1
- Financial Transaction Manager for High Value Payments for Multi-Platform
- 3.2.4
- WebSphere Application Server
- 9.0
- 8.5
- 8.0
- 7.0
- IBM CICS Transaction Gateway
- 8.0
- 8.1
- 9.0
- 9.1
- 9.2
- IBM i2 Analyst's Notebook Premium
- 9.2.1
- Watson Machine Learning Service
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Denial of service attack (DoS)
- Unauthorized disclosure of information
- Escalation of privilege
- Cross-site scripting (XSS)
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-addressed-multiple-vulnerabilities/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-websphere-application-server-for-ibm-cloud-private-vm-quickstarter/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-has-been-identified-in-apache-cxf-which-is-shipped-with-ibm-tivoli-network-manager-cve-2020-1954/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-i2-analysts-notebook-memory-vulnerabilities/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-aix-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-manager-for-high-value-payments-is-
- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-server-is-vulnerable-to-a-remote-code-execution-vulnerability-cve-2020-4534/
- https://www.ibm.com/blogs/psirt/security-bulletin-apr-2020-multiple-vulnerabilities-in-ibm-java-runtime-affect-cics-transaction-gateway/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-i2-analysts-notebook-and-ibm-i2-analysts-notebook-premium-memory-vulnerabilities/
- https://www.ibm.com/blogs/psirt/security-bulletin-watson-machine-learning-service-is-impacted-by-security-vulnerabilities-in-openjdk-11/
- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-manager-for-high-value-payments-is-affected-by-a-potential-cross-site-scripting-reflected-vulnerability-cve-2020-4560/