The official site for Saudi CERT
IBM Alert
2594
Warning Date
Severity Level
Warning Number
Target Sector
30 June, 2022
● High
2022-5023
All
Description:
IBM has released security updates to address several vulnerabilities in the following products:
- IBM Spectrum Protect Client
- 8.1.0.0-8.1.14.0
- IBM® Db2® On Openshift
- v11.5.5.0 – v11.5.5.0-cn4
- v11.5.5.1 – v11.5.5.1-cn3
- v11.5.6.0 – v11.5.6.0-cn5
- v11.5.7.0 – v11.5.7.0-cn4
- IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data
- v3.5 through refresh 10
- v4.0 through refresh 9
- IBM Spectrum Protect Plus
- 10.1.0-10.1.10.2
- IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
- 10.1.5-10.1.10.2
- IBM Spectrum Protect Plus Container Backup and Restore for Red Hat OpenShift
- 10.1.7-10.1.10.2
- IBM Cloud Pak for Multicloud Management Monitoring
- 2.0 – 2.3 Fix Pack 4
- Watson Discovery
- 4.0.0-4.0.9
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Obtain sensitive information
- Denial of service (DoS)
- Execute arbitrary code
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnerability-in-openssl-may-affect-ibm-spectrum-protect-backup-archive-client-cve-2022-0778/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-affect-ibm-db2-on-openshift-and-ibm-db2-and-db2-warehouse-on-cloud-pak-for-data-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-linux-kernel-affect-ibm-spectrum-protect-plus-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-multicloud-management-monitoring-is-vulnerable-to-various-attacks-due-to-its-use-of-redis-cve-2021-32675-cve-2021-32626-cve-2021-32672/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-golang-go-and-minio-may-affect-ibm-spectrum-protect-plus-container-backup-and-restore-for-kubernetes-and-red-hat-openshift-cve-2022-24842cve-2021-38561cve-2021/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-multicloud-management-monitoring-is-vulnerable-to-several-attack-vectors-due-to-its-use-of-apache-netty-cve-2021-37136-cve-2021-37137-cve-2021-43797/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-ibm-cloud-pak-for-data-affected-by-vulnerability-in-apache-tomcat/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-multicloud-management-monitoring-is-vulnerable-to-directory-traversal-due-to-its-use-of-apache-commons-io-cve-2021-29425/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-ibm-cloud-pak-for-data-affected-by-vulnerability-in-node-js-10/
Rate the content
Share the page
