IBM Updates
2915Warning Date
Severity Level
Warning Number
Target Sector
27 August, 2020
● Medium
2020-1692
All
Description:
IBM has released security updates to address multiple vulnerabilities in the following products:
- IBM CICS TX on Cloud
- 10.1.0.0
- IBM Spectrum Scale
- 5.0.0 – 5.0.5
- IBM Security Guardium Insights
- 2.0.1
- WebSphere Application Server ND
- 9.0
- 8.5
- WebSphere Virtual Enterprise
- 8.0
- 7.0
- IBM Tivoli Composite Application Manager for SOA
- IBM TXSeries for Multiplatforms
- 8.2.0.0 – 8.2.0.2
- 9.1.0.0 – 9.1.0.1
- IBM Operations Analytics Predictive Insights
- 1.3.6
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Denial of service (DoS).
- Privilege esclation.
- Cross-site scripting (XSS) attack.
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-java-runtime-environment-affects-ibm-cics-tx-on-cloud/
- https://www.ibm.com/blogs/psirt/security-bulletin-openstack-keystone-vulnerabilities-affects-ibm-spectrum-scale-cve-2020-12689/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-insights-is-affected-by-multiple-vulnerabilities/
- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-server-nd-is-vulnerable-to-cross-site-scripting-cve-2020-4575/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-runtime-affect-itcam-for-soa-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-insights-is-affected-by-ibm-sdk-java-technology-edition-quarterly-cpu-apr-2020-vulnerabilities/
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-2654-in-ibm-runtime-environment-java-affects-txseries-for-multiplatforms/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-netty-4-1-x-before-4-1-46-affects-ibm-operations-analytics-predictive-insights-cve-2020-11612/