IBM Updates
2825Warning Date
Severity Level
Warning Number
Target Sector
29 September, 2020
● Medium
2020-1851
All
Description:
IBM has released security updates to address multiple vulnerabilities in the following products:
- Aspera on Cloud
- IBM Cloud Pak for Data – Node.js
- CP4D - 2.5
- CP4D - 3.0
- IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™
- IBM i - 7.4
- IBM i - 7.3
- IBM i - 7.2
- IBM i - 7.1
- IBM Cloud Private
- 3.2.1 CD
- 3.2.2 CD
- App Connect Enterprise Certified Container
- 1.0.0 with Operator
- 1.0.1 with Operator
- 1.0.2 with Operator
- 1.0.3 with Operator
- IBM Security Verify Privilege Vault Remote
- 1.2
Threats:
An attacker could exploit these vulnerabilities by doing the following:
- Obtain sensitive information.
- Denial of service (DoS).
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-affect-ibm-cloud-pak-for-data-node-js-cve-2020-15095/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java-runtime-for-ibm-i-is-affected-by-cve-2020-2601/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vulnerable-to-a-kubernetes-vulnerability-cve-2020-8553/
- https://www.ibm.com/blogs/psirt/security-bulletin-aspera-on-cloud-cve-2020-8184/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java-runtime-for-ibm-i-is-affected-by-cve-2020-2590/
- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-certified-container-is-vulnerable-to-a-regular-expression-infinite-loop-node-security-1488/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vulnerable-to-kubernetes-vulnerabilities-cve-2020-8557-cve-2020-8559/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-and-ibm-java-runtime-affect-ibm-i-4/
- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-certified-container-is-vulnerable-to-an-infinite-read-loop-cve-2020-16845/
- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-certified-container-is-vulnerable-to-cve-2020-8244/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-privilege-vault-remote-is-vulnerable-to-local-user-security-bypass-cve-2020-4607/