"IBM Patches High-Severity Vulnerabilities in Cloud, Voice, Security Products"

IBM recently announced patches for multiple high-severity vulnerabilities impacting products such as Netezza for Cloud Pak for Data, Voice Gateway, and SiteProtector.  Three vulnerabilities were resolved in IBM Netezza for Cloud Pak for Data, all of which impact the Golang packages that the platform uses.  Two of these issues are rated "high severity," with a CVSS score of 7.5.  IBM noted that all three flaws are denial-of-service (DoS) vulnerabilities in Golang that could be exploited remotely using specially crafted content or requests.  The bugs impact Netezza for Cloud Pak for Data versions 11.2.1.0 to 11.2.1.5 and have been addressed with the release of version 11.2.1.6 of the platform.  IBM also announced patches for five Node.js vulnerabilities that impact Voice Gateway, including two rated "high severity," which could lead to privilege escalation or arbitrary code execution.  The bugs impact Voice Gateway 1.0.7, 1.0.7.1, and 1.0.8.  IBM recently released the new Voice Gateway 1.0.8.x images that contain fixes for all five issues.  IBM also patched six vulnerabilities in the SiteProtector system, all of which impact the Apache HTTP Server.  The most severe of these is a high-severity request smuggling bug.  The issues impact IBM Security SiteProtector system version 3.1.1 and have been addressed with the release of version 3.1.1.19 of the appliance.  IBM also patched a "medium-severity" identity spoofing flaw in Liberty for Java for IBM Cloud.  

SecurityWeek reports: "IBM Patches High-Severity Vulnerabilities in Cloud, Voice, Security Products"