IBM Updates
2873Warning Date
Severity Level
Warning Number
Target Sector
12 July, 2020
● Medium
2020-1480
All
Description:
IBM has released security updates to address multiple vulnerabilities in the following products:
- IBM Content Classification
- 8.8
- StoredIQ
- 7.6.0.0 – 7.6.0.20
- IBM Maximo Asset Management
- 7.6.0
- 7.6.1
- IBM Cloud Pak System
- 2.3, 2.3.0.1
- InfoSphere Information Server, Information Server on Cloud
- 11.7.1.1 and earlier
- 11.5
- InfoSphere Information Server
- 11.3
- IBM Netezza Host Management
- 5.4.9.0 – 5.4.26.0
- IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
- 2.5
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Denial of service (DoS).
- Obtain sensitive information remotely.
- Remote code execution.
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-2949-may-affect-ibm-sdk-java-technology-edition-for-ibm-content-classification/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-edition-quarterly-cpu-jan-2020-includes-oracle-jan-2020-cpu-affect-ibm-content-classification/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-ibm-storediq/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-management-is-vulnerable-to-security-authentication-bypass-cve-2019-4591/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-storediq-is-affected-by-a-vulnerability-in-nginx-cve-2019-20372/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-identified-in-apache-activemq-used-in-cloud-pak-system-cve-2020-1941-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-information-server-is-affected-by-a-remote-code-execution-vulnerability/
- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulnerability-from-kernel-affects-ibm-netezza-host-management/
- https://www.ibm.com/blogs/psirt/security-bulletin-missing-or-insecure-content-security-policy-header-affecting-watson-knowledge-catalog-for-ibm-cloud-pak-for-data/
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-2949-may-affect-ibm-sdk-java-technology-edition-for-ibm-content-classification/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-edition-quarterly-cpu-jan-2020-includes-oracle-jan-2020-cpu-affect-ibm-content-classification/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-ibm-storediq/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-management-is-vulnerable-to-security-authentication-bypass-cve-2019-4591/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-storediq-is-affected-by-a-vulnerability-in-nginx-cve-2019-20372/