IBM Updates
2661Warning Date
Severity Level
Warning Number
Target Sector
22 September, 2020
● High
2020-1814
All
Description:
IBM has released security updates to address vulnerabilities in the following products:
- IBM SDK, Java Technology Edition Quarterly CPU
- DB2 Query Management Facility for z/OS 11.2.1, 12.1, 12.2, 11.2
- Query Management Facility Classic Edition 11.1
- Query Management Facility Enterprise Edition 11.1
- IBM Cloud Manager 4.3
- Node.j
- BM App connect Enterprise V11 , V11.0.0.0 – V11.0.0.9
- DataQuant for z/OS 2.1
- Apache ZooKeeper
- QRadar / QRM / QVM / QRIF / QNI 7.4.1 GA
- IBM Data Risk Manager 2.0.6
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Sensitive information disclosure
- Denial of service attack (DoS)
- Execute arbitrary code -remotely
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-edition-quarterly-cpu-jul-2020-includes-oracle-jul-2020-cpu-plus-one-additional-vulnerability/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-js-affect-ibm-app-connect-enterprise-v11/
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-2590-deferred-from-oracle-jan-2020-cpu/
- https://www.ibm.com/blogs/psirt/security-bulletin-apache-zookeeper-as-used-by-ibm-qradar-siem-is-vulnerable-to-information-disclosure-cve-2019-0201/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-ibm-cloud-manager-with-openstack-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-2601-deferred-from-oracle-jan-2020-cpu/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-edition-quarterly-cpu-jul-2020-includes-oracle-jul-2020-cpu-plus-one-additional-vulnerability-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-risk-manager-is-affected-by-multiple-vulnerabilities-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-2601-deferred-from-oracle-jan-2020-cpu-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-2590-deferred-from-oracle-jan-2020-cpu-2/