Security Bulletin: Denial of Service vulnerability in OpenSSL may affect IBM Spectrum Protect Backup-Archive Client (CVE-2022-0778)
The OpenSSL vulnerabilities were announced by the OpenSSL project on March 15, 2022. OpenSSL, which is used by IBM Spectrum Protect Backup-Archive Client for network connections to NetApp services, has closed the affected vulnerability.
Details of the vulnerability
CVEID: CVE-2022-0778
CVSS base rating: 7.5
Description
OpenSSL is vulnerable to a denial of service caused by a flaw in the BN_mod_sqrt() function when parsing certificates. By using a specially crafted certificate with invalid explicit curve parameters, a remote attacker can exploit this vulnerability to cause an infinite loop, resulting in a denial-of-service condition.
Affected platforms: Linux, Windows
Affected ISP B/A client versions: 8.1.0.0 - 8.1.14.0
Security Bulletin: Information Disclosure and Denial of Service Vulnerabilities in IBM Spectrum Protect Backup-Archive Client (CVE-2022-22478, CVE-2022-22474)
The IBM Spectrum Protect backup archive client is vulnerable to information disclosure because user credentials are stored in memory in clear text. The backup archive client is also vulnerable to a denial of service due to certain reads on TCP/IP sockets.
Vulnerability details
CVEID: CVE-2022-22478
CVSS base rating: 6.2
Description
IBM Spectrum Protect Client stores user credentials in plain text that can be read by a local user.
CVEID: CVE-2022-22474
CVSS base score: 5.9
Description
The IBM Spectrum Protect processes dsmcad, dsmc, and dsmcsvc incorrectly handle certain reads on TCP/IP sockets. This can result in a denial of service for IBM Spectrum Protect client operations.
Affected platforms: AIX, HP-UX, Linux, Macintosh, Solaris, Windows
Affected ISP B/A client versions: 8.1.0.0 - 8.1.14.0
Fixing Level
8.1.15.0
IBM FTP Download Links
https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/
IBM Spectrum Protect Security Bulletin Download Links Overview
IBM WebSphere Application Server Liberty vulnerabilities affect IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Virtual Environments, and IBM Spectrum Protect for Space Management (CVE-2021-35517, CVE-2021-36090)
Security Bulletin: Vulnerability in IBM Dojo affects IBM Spectrum Protect for Virtual Environments (CVE-2021-23450)
Security Bulletin: IBM WebSphere Application Server Liberty vulnerabilities affect IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Virtual Environments, and IBM Spectrum Protect for Space Management (CVE-2021-35517, CVE-2021-36090)
Security Bulletin: Vulnerabilities in IBM Java Runtime and Golang Go affect IBM Spectrum Protect Server (CVE-2021-35578, CVE-2021-44716, CVE-2021-44717)
Security Bulletin: Vulnerabilities in IBM Db2 affect IBM Spectrum Protect Server (CVE-2021-38931, CVE-2021-29678, CVE-2021-20373, CVE-2021-39002, CVE-2021-38926)
Security Bulletin: IBM Spectrum Protect 8.1.14.000 Server is vulnerable to bypass of security restrictions (CVE-2022-22394)
Security Bulletin: IBM Spectrum Protect Server may not count invalid sign-on attempts from Operations Center (CVE-2022-224485)
IBM Spectrum Protect Plus™
Security Bulletin: IBM Spectrum Protect Plus may disclose sensitive information in virgo log file (CVE-2022-22396)
Security Bulletin: Heap-Based Buffer Overflow in Mozilla Network Security Services (NSS) may affect IBM Spectrum Protect Plus (CVE-2021-43527)
Security Bulletin: Vulnerabilities in the Linux Kernel, Samba, Sudo, Python, and tcmu-runner affect IBM Spectrum Protect Plus
Security Bulletin: Denial of Service Vulnerability in Golang Go affects IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift (CVE-2022-24921)
Security Bulletin: Vulnerabilities in Polkit, Node.js, OpenSSH, and Golang Go affect IBM Spectrum Protect Plus (CVE-2021-4034, CVE-2022-21681, CVE-2022-21680, CVE-2022-0235, CVE-2021-41617, CVE-2021-44716, CVE-2021-44717, 218243)
Security Bulletin: Vulnerabilities in Celery, Golang Go, and Python affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift
Security Bulletin: Vulnerability in Flask and Python affects IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore (CVE-2021-33026, CVE-2022-0391)
Security Bulletin: IBM Spectrum Protect Plus is vulnerable to PostgreSQL Man-in-the-Middle and Slowloris Denial of Service attacks (CVE-2021-23222, CVE-2022-22354)
If you have any further questions, please do not hesitate to contact us.
Your Empalis Team
