IBM Updates
2819Warning Date
Severity Level
Warning Number
Target Sector
6 October, 2020
● High
2020-1880
All
Description:
IBM has released security updates to address vulnerabilities in the following products:
- Apache Commons Codec
- IBM Secure Proxy 6.0.0 – 6.0.1.1 iFix 1
- IBM Sterling Secure Proxy 3.4.0 – 3.4.3.2 iFix 8
- BM SDK Java Technology Edition Version 1.8
- RST 9.1, 9.2, 9.5
- RPT 9.1, 9.2, 9.5
- IBM Runtime Environment Java Version 1.8
- RST 9.1, 9.2, 9.5
- RPT 9.1, 9.2, 9.5
- IBM Security Guardium 10.6, 11.0, 11.1
- BM DataPower Gateway 10.0.0.0, 2018.4.1.0-2018.4.1.12
- IBM Security Access Manager 9.0.7.2
- IBM WebSphere Liberty
- ISAM 8.0, 9.0
- IBM Maximo Asset Management 7.6.0, 7.6.1
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Sensitive information disclosure
- Denial of service attack (DoS)
- Execute arbitrary code
- Bypass of a protection mechanism
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-commons-codec-affects-ibm-sterling-secure-proxy-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-and-ibm-java-runtime-affect-rational-service-tester/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-and-ibm-java-runtime-affect-rational-performance-tester/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-python-vulnerabilities/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-may-allow-a-potential-dos-when-importing-malicious-zip-files-cve-2019-13232/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-an-oracle-mysql-vulnerability-2/
- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-xss-fixed-in-ibm-security-access-manager-9-0-7-2-cve-2019-4725/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-fixed-in-ibm-websphere-liberty-as-shipped-in-ibm-security-access-manager/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-can-expose-remote-credentials-to-local-users-cve-2020-4528/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-is-potentially-vulnerable-to-a-denial-of-service-cve-2020-14147/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-management-is-vulnerable-to-multiple-jackson-databind-cves-february-2020/