The official site for Saudi CERT
IBM Updates
2470
Warning Date
Severity Level
Warning Number
Target Sector
24 February, 2021
● Critical
2021-2523
All
Description:
IBM has released a security update to address several vulnerabilities in the following products:
- OpenSSL
- IBM WIoTP MessageGateway 5.0.0.1
- Node.js
- IBM Integration Bus V10.0.0 – V10.0.0.23
- Node.js nodemailer module
- IBM Cloud Pak for Multicloud Management Infrastructure Management
- IBM Cloud Pak for Security 1.5.0.0, 1.5.0.0
- OpenLDAP
- MessageGateway
- IBM MQ Appliance 9.1 LTS, 9.2 LTS, 9.1 CD
- IBM Dependency Based Build server web UI
- IBM Java Runtime
- IBM WIoTP MessageGateway 5.0.0.1
- IBM IoT MessageSight 5.0.0.0, 2.0.0.2
- Integration Designer 8.5.7, 19.0.0.2, 20.0.0.1, 20.0.0.2
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Execute arbitrary commands -remotely
- Denial of service attack (DoS)
- Bypass of a protection mechanism -remotely
Best practice and Recommendations:
The CERT team encourages users to review IBM security advisory and apply the necessary updates:
- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-publicly-disclosed-vulnerabilities-affect-messagegateway-cve-2021-23841-cve-2021-23840/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-in-node-js-nodemailer-module-affects-ibm-cloud-pak-for-multicloud-management/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-security-is-vulnerable-to-cookie-spoofing-cve-2019-12749/
- https://www.ibm.com/blogs/psirt/security-bulletin-openldap-publicly-disclosed-vulnerabilities-affects-messagegateway-ccve-2020-36230-cve-2020-36229/
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affected-by-a-denial-of-service-vulnerability-cve-2020-4931/
- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-js-affect-ibm-integration-bus-cve-2020-7760/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-java-runtime-affects-ibm-messagegateway/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-cves-vulnerabilities-in-ibm-java-runtime-affect-ibm-integration-designer-used-in-ibm-business-automation-workflow-and-ibm-business-process-manager-3/
- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-in-node-js-nodemailer-module-affects-ibm-cloud-automation-manager/
- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-runtime-affect-ibm-messagegateway-cve-2020-14797-cve-2020-14779-cve-2020-14796/
- https://www.ibm.com/blogs/psirt/security-bulletin-clickjacking-vulnerability-identified-in-ibm-dependency-based-build-server-web-ui/
Rate the content
Share the page
