IBM Alert
2912Warning Date
Severity Level
Warning Number
Target Sector
10 March, 2022
● High
2022-4503
All
IBM has released security updates to address several vulnerabilities in the following products:
- OmniFind Text Search Server for DB2 for i
- V1R5M0
- V1R4M0
- V1R3M0
- IBM DataPower Gateway
- 10.0.2.0
- 10.0.3.0
- 10.0.1.0-10.0.1.5
- 2018.4.1.0-2108.4.1.18
- AIX
- 7.1
- 7.2
- 7.3
- VIOS
- 3.1
- IBM Cloud Pak System
- V2.3
- V2.3.1.1
- V2.3.2.0
- v2.3.3.1
- V2.3.3.2
- V2.3.3.3
- V2.3.3.3 ifix1
- IBM Guardium Data Encryption (GDE)- CipherTrust Tokenization Server (CT-VL)
- 2.6.3 and lower
- IBM Guardium Data Encryption (GDE) - Guardium Cloud Key Manager (GCKM)
- GCKM 1.10.1 and lower
- IBM Cloud Application Business Insights
- 1.1.7
- 1.1.6
- 1.1.5
An attacker could exploit these vulnerabilities by doing the following:
- Denial of Service (DoS) attack
- Bypass security restrictions
- Gain elevated privileges
- Information disclosure
- Code execution
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-due-to-use-of-apache-log4j-omnifind-text-search-server-for-db2-for-i-is-vulnerable-to-arbitrary-code-execution-cve-2021-4104/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-permits-reflected-json-injection-cve-2021-38910/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-bind-affects-aix-cve-2021-25219-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-intel-xeon-affects-ibm-cloud-pak-system-cve-2021-0144-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-guardium-data-encryption-is-vulnerable-to-cross-site-scripting-cve-2020-7676/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-websphere-application-server-liberty-affects-ibm-cloud-application-business-insights-cve-2021-23450/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-guardium-data-encryption-gde-has-an-information-exposure-vulnerability-cve-2021-39025/