The official site for Saudi CERT
IBM Alert
2789
Warning Date
Severity Level
Warning Number
Target Sector
21 July, 2022
● Critical
2022-5047
All
IBM has released security updates to address several vulnerabilities in several products:
- async opensource package
- IBM VM Recovery Manager HA & DR GUI
- OpenSSL
- IBM Security Verify Information Queue web server
- BM Security Verify Governance, Identity Manager virtual appliance component
- Google gRPC
- IBM Security Verify Information Queue
- Wire Schema jar
- IBM Security Verify Information Queue
- IBM® DB2®
- IBM PureData System for Operational Analytics
- IBM Security Verify Information Queue connect image
- Oracle JDBC jar
- IBM Security Verify Information Queue
- IBM Security Access Manager appliance
- Apache Log4j
- IBM Tivoli Network Manager
Attacker could exploit these vulnerabilities by doing the following:
- Execute arbitrary code remotely
- Denial of service attack (DoS)
- Unauthorized modification
- Bypass of a protection mechanism
- Buffer overflow
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-async-opensource-package-affects-ibm-vm-recovery-manager-ha-dr-gui-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerabilities-in-the-ibm-security-verify-information-queue-web-server-cve-2021-3711-cve-2021-3712/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-found-in-open-source-code-that-is-shipped-with-ibm-security-verify-governance-identity-manager-virtual-appliance-component/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-information-queue-uses-a-google-grpc-framework-with-multiple-vulnerabilities-cve-2017-7860-cve-2017-7861-cve-2017-9431/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-information-queue-uses-a-wire-schema-jar-with-multiple-vulnerabilities-cve-2020-27853-cve-2021-41093/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-have-been-identified-in-ibm-db2-shipped-with-ibm-puredata-system-for-operational-analytics/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-security-verify-information-queue-connect-image-cve-2020-9493-cve-2022-23307/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-information-queue-uses-an-oracle-jdbc-jar-with-multiple-vulnerabilities-cve-2019-2444-cve-2019-2619-cve-2017-10321-cve-2017-10202/
- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-have-been-fixed-in-ibm-security-access-manager-appliance-cve-2022-24407-cve-2020-25709-cve-2020-25710/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-network-manager-is-vulnerable-to-arbitrary-code-execution-due-to-apache-log4j-cve-2019-1757/
Rate the content
Share the page
