IBM Alert
3107Warning Date
Severity Level
Warning Number
Target Sector
3 March, 2022
● Critical
2022-4467
All
IBM has released security updates to address several vulnerabilities in the following products:
- IBM Rational Build Forge
- 8.0 – 8.0.0.20
- IBM DataPower Gateway
- 10.0.2.0
- 10.0.3.0
- 10.0.1
- 10.0.1.0
- 10.0.1.1
- 10.1.1.2
- 10.0.1.3
- 10.0.1.4
- 10.0.1.5
- IBM Navigator for i (heritage version only)
- 7.4
- 7.3
- 7.2
- Integrated Web Server (IWS)
- 7.4
- 7.3
- 7.2
- 2.6
- IBM i Access Client Solutions
- 1.1.8.6 and earlier
- IBM OpenPages with Watson
- 8.2.0.4 - 8.2.0.4 Interim Fix 2 (8.2.0.4.2)
- IBM HTTP Server
- 9.0
- 8.5
- 8.0
- 7.0
- IBM Robotic Process Automation
- < 21.0.1
An attacker could exploit these vulnerabilities by doing the following:
- Cross-site scripting (XSS) attack
- Denial of service attack (DoS)
- Bypass security restrictions
- Remote code execution
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rational-build-forge-is-affected-by-apache-http-server-version-used-in-it-cve-2021-44790-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-affected-by-vulnerabilities-in-node-js/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-i-components-are-affected-by-cve-2021-4104-log4j-version-1-x-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-openpages-with-watson-has-addressed-apache-log4j-vulnerability-cve-2021-44832/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-http-server-used-by-ibm-websphere-application-server-due-to-expat-vulnerabilities-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-http-server-used-by-ibm-websphere-application-server-due-to-expat-vulnerabilities-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-may-affect-ibm-robotic-process-automation/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-i-is-vulnerable-to-bypass-security-restrictions-due-to-samba-smb1-cve-2021-43566-and-cve-2021-44141/