IBM Updates
3627Warning Date
Severity Level
Warning Number
Target Sector
15 October, 2020
● High
2020-1932
All
Description:
IBM has released security updates to address vulnerabilities in the following products:
- ISAM
- 9.0.7
- 9.0
- 8.0
- IBM Security Verify Access
- 10.0.0
- Netcool Operations Insight – Cloud Native Event Analytics
- 1.6.0
- 1.6.1
- IBM Tivoli Application Dependency Discovery Manager
- 7.3.0.7
- Tivoli Federated Identity Manager
- 6.2.2
- IBM Network Performance Insight
- 1.3.1
- IBM Operational Decision Manager
- 8.10.x
- 8.9.x
- 8.8.x
- 8.7.x
- WebSphere Application Server Liberty
- 17.0.0.3 – 20.0.0.10
- IBM Netcool Agile Service Manager
- 1.1
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Obtain sensitive information.
- Bypass security restrictions.
- Denial of service (DoS).
- Execute arbitrary code.
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-have-been-fixed-in-the-ibm-security-access-manager-and-ibm-security-verify-access-products/
- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-cloud-native-event-analytics-is-affected-by-an-apache-commons-codec-vulnerability/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-struts-affect-ibm-tivoli-application-dependency-discovery-manager/
- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-have-been-identified-in-ibm-java-runtime-as-shipped-with-tivoli-federated-identity-manager-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-component-ibm-network-performance-insight-1-3-1-affected-by-cve-2020-14062/
- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-in-ibm-websphere-liberty-fixed-in-ibm-security-access-manager-appliance/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-sdk-java-technology-edition-affect-ibm-operational-decision-manager/
- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-component-ibm-network-performance-insight-1-3-1-affected-by-cve-2020-14195/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-hibernate-validator-affects-websphere-application-server-liberty-cve-2020-10693/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-runtime-affect-ibm-netcool-agile-service-manager-5/