Skip to content
OpenAdvisories
High WID-SEC-2022-1461 39 CVEs

IBM Spectrum Protect: Mehrere Schwachstellen

Published Sep 18, 2022 · Updated Jun 20, 2023 · Revision 2 · de-DE

Vendor: IBM Product: Spectrum Protect Product: Spectrum Protect < 10.1.12 Product: Spectrum Protect < 8.1.16 Product: Spectrum Protect plus 10.1 Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.

Product

IBM Spectrum Protect ist eine zentralisierte Backuplösung für Systeme im Netzwerk.

Vulnerabilities 39

  • Critical 9.8
    CVE-2022-1292 Public exploit EPSS 83%

    The c_rehash script allows command injection

    The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2022-2068 EPSS 96%

    The c_rehash script allows command injection

    In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2022-32213 EPSS 45%

    llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

    Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  • Critical 9.1
    CVE-2022-32214 EPSS 82%

    llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

    Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  • High 8.1
    CVE-2022-22576

    An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-a…

    curl curl curl Debian Ubuntu Alpine
  • High 7.8
    CVE-2022-30580

    Empty Cmd.Path can trigger unintended binary in os/exec on Windows

    Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

    Go standard library os/exec golang go Azure Linux Alpine Go
  • High 7.5
    CVE-2018-25032 Public exploit EPSS 52%

    Nokogiri affected by zlib's Out-of-bounds Write vulnerability

    zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

    mariadb-10.3 mariadb-10.6 mariadb openjpeg2 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  • High 7.5
    CVE-2021-22946

    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or F…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2022-2097 Public exploit

    AES OCB fails to encrypt some bytes

    AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io
  • High 7.5
    CVE-2022-27782

    libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2022-30631

    Stack exhaustion when reading certain archives in compress/gzip

    Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

    Go standard library compress/gzip golang go Debian Ubuntu Azure Linux Alpine Go
  • High 7.5
    CVE-2022-30633

    Stack exhaustion when unmarshaling certain documents in encoding/xml

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

    Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go
  • High 7.5
    CVE-2022-31028

    Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

    MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP cl…

    minio minio
  • High 7.4
    CVE-2022-35919 Public exploit EPSS 52%

    Authenticated requests for server update admin API allows path traversal in minio

    MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path req…

    minio minio
  • Medium 6.6
    CVE-2021-42550

    RCE from attacker with configuration edit priviledges through JNDI lookup

    In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

    QOS.ch logback logback logback Debian Ubuntu Maven
  • Medium 6.5
    CVE-2022-1705

    Improper sanitization of Transfer-Encoding headers in net/http

    Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

    Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  • Medium 6.5
    CVE-2022-22389

    IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server …

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.2
    CVE-2022-22390

    IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caus…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 5.9
    CVE-2021-22947

    When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS …

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2022-40234

    Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a ce…

    IBM Spectrum Protect Plus
  • Medium 5.9
    CVE-2022-40608

    IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the …

    IBM Spectrum Protect Plus
  • Medium 5.7
    CVE-2022-27774

    An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that c…

    curl curl curl Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2022-29526

    golang.org/x/sys/unix has Incorrect privilege reporting in syscall

    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

    golang stdlib k3d golang-1.8 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.3
    CVE-2022-33987

    Got allows a redirect to a UNIX socket

    The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

    node-got node-got got Debian Ubuntu npm
  • Medium 5.0
    CVE-2022-22476

    IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing…

    IBM WebSphere Application Server - Liberty
  • Low 3.1
    CVE-2022-30629

    Session tickets lack random ticket_age_add in crypto/tls

    Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-3759

    A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a …

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2022-23772

    Uncontrolled memory consumption in math/big

    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23773 Public exploit

    Incorrect access control in the go command in cmd/go/internal/modfetch

    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

    golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-23806

    Incorrect computation for some invalid field elements in crypto/elliptic

    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

    golang go stdlib lxd Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-24675 Public exploit

    Stack overflow from a large amount of PEM data in encoding/pem

    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-27776

    A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header…

    curl curl curl Debian Ubuntu Alpine
  • Unscored —
    CVE-2022-29361 Public exploit

    Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggli…

    werkzeug py3-werkzeug Alpine PyPI
  • Unscored —
    CVE-2022-29804

    Path traversal via Clean on Windows in path/filepath

    Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

    Go standard library path/filepath golang go Azure Linux Alpine Go
  • Unscored —
    CVE-2022-30634

    Indefinite hang with large buffers on Windows in crypto/rand

    Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

    Go standard library crypto/rand golang go Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-32212

    A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2022-32215 EPSS 70%

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …

    Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2022-32222

    A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default p…

    Node.js node nodejs-current Alpine
  • Unscored —
    CVE-2022-32223 Public exploit

    Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulner…

    Node.js node

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References