Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2199
Security Bulletin: Speech to Text, Text to Speech ICP,
WebSphere Application Server Liberty Fix
25 June 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: WebSphere Application Server Liberty
Publisher: IBM
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Denial of Service -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Provide Misleading Information -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-4329 CVE-2019-17573 CVE-2019-4720
Reference: ESB-2020.2189
ESB-2020.2050
ESB-2020.1835
Original Bulletin:
https://www.ibm.com/support/pages/node/6238342
https://www.ibm.com/support/pages/node/6238340
https://www.ibm.com/support/pages/node/6238332
Comment: This bulletin contains three (3) IBM security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix
Security Bulletin
Summary
A WebSphere liberty vulnerability to a DOS has been fixed in Liberty 20.0.0.5.
This fix is included in ICP Watson_Text_to_Speech, Speech to Text v1.1.2 (6/19/
20).
Vulnerability Details
CVEID: CVE-2019-4720
DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is
vulnerable to a denial of service, caused by sending a specially-crafted
request. A remote attacker could exploit this vulnerability to cause the server
to consume all available memory. IBM X-Force ID: 172125.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
172125 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
+---------------------------------------+----------+
|Affected Product(s) |Version(s)|
+---------------------------------------+----------+
|IBM Watson Speech to Text Customer Care|1.0.1-1.1 |
+---------------------------------------+----------+
Remediation/Fixes
A WebSphere liberty vulnerability to a DOS has been fixed in Liberty 20.0.0.5.
This fix is included in ICP Watson_Text_to_Speech, Speech to Text v1.1.2 (6/19/
20). Please download and install the latest version to receive this fix.
Workarounds and Mitigations
None
- ------------------------------------------------------------------------------
Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix
Security Bulletin
Summary
A vulnerability in Apache CXF affecting WebSphere Liberty JAX-WS has been fixed
in Liberty: 20.0.0.5. This fix is included in ICP Watson Text to Speech, Speech
to Text v1.1.2 (GA: 6/19/20).
Vulnerability Details
CVEID: CVE-2019-17573
DESCRIPTION: Apache CXF is vulnerable to cross-site scripting, caused by
improper validation of user-supplied input by the services listing page. A
remote attacker could exploit this vulnerability using a specially-crafted URL
to execute script in a victim's Web browser within the security context of the
hosting Web site, once the URL is clicked. An attacker could use this
vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
174689 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
+-----------------------------------------+----------+
|Affected Product(s) |Version(s)|
+-----------------------------------------+----------+
|IBM Watson Speech to Text, Text to Speech|1.0.1-1.1 |
+-----------------------------------------+----------+
Remediation/Fixes
A vulnerability in Apache CXF affecting WebSphere Liberty JAX-WS has been fixed
in Liberty: 20.0.0.5. This fix is included in ICP Watson Text to Speech, Speech
to Text v1.1.2 (GA: 6/19/20). Please download and install the latest version to
receive this fix.
Workarounds and Mitigations
None
- -------------------------------------------------------------------------------
Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix
Security Bulletin
Summary
An information disclosure in WebSphere Application Server - Liberty Medium
CVE-2020-4329 has been fixed in WebSphere Application Server Liberty 20.0.0.5,
included in ICP Watson_Text_to_Speech and Speech to Text v1.1.2 (GA: 6/19/20).
Vulnerability Details
CVEID: CVE-2020-4329
DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty
17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to
obtain sensitive information, caused by improper parameter checking. This could
be exploited to conduct spoofing attacks. IBM X-Force ID: 177841.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
177841 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
+-----------------------------------+---------+
|Affected Product(s) |Version |
| |(s) |
+-----------------------------------+---------+
|IBM Watson Speech to Text, Text to |1.0.1 - |
|Speech |1.1 |
+-----------------------------------+---------+
Remediation/Fixes
An information disclosure in WebSphere Application Server - Liberty Medium
CVE-2020-4329 has been fixed in WebSphere Application Server Liberty 20.0.0.5,
included in ICP Watson_Text_to_Speech and Speech to Text v1.1.2 (GA: 6/19/20).
Please download and install the latest version to receive this fix.
Workarounds and Mitigations
None
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXvQnReNLKJtyKPYoAQiJdxAAjHaHptqT+5Vu25fMMo5iy4kmdsZK5nV6
8v4hYd/CYl/5Qp/W0Uz4+gpa0Dh5HCDxFcX9GY5EgR46I/xoYO9Th1plYsNCp/7Y
5OgWGWV++QQ6ooliPJydl2xi1ADCOXYfB8222OZlglyJiCBxtvVXJMM9yH9hBKBv
sUtIr4A/keGAibkm64aUVRpjQbtU9M5eOoGghfEAJlC5G2uvySC9HGOUTajT38E0
65Vnc6oQBamglkVlwbjgkuqA01ieGUuJkbZQuzC2m1PeAJM8p1NTM7DE+3AZC6EM
H9MZmf2COQV+gDM+7mDSN0E4DYIgjI/PK5YvwC69fxejTCGYBCQq13I1V6vMctK5
i2RPHigmYXuSipZZqZ+nfuyqW/w4J7HAa/T8IQCwGpnolSmRgQuFj2iCVf38aFvn
IPOrFGlBWgdrBybvwFpneEjBqSLh2IIvlRK2EF0QSDcgOxAOgS4JLUNBbeS9w4MT
IFwGeW49HAj2c24sMtVIQ7A2v8EhNZ3zFqwFLHbQB6zH0vgfgs+K7wWMt/FmXkb9
L+2FYNI4wmm7/lb08TdIIdatozjJ5Yi5fez4dGdkn/DIFrkKML4+LJx4bvwQmPwI
spJO+EUralPRvDt+mK20wuBiQI2GZSf3YQdR7gUtvLQQpEvLkTsvZLKNOEUqZxtb
PcLC2FxSoM8=
=2ugM
-----END PGP SIGNATURE-----