Main Vulnerability Database SB2022010521

SB2022010521 - IBM Cloud Private update for Netty

Published: January 5, 2022

Security Bulletin ID SB2022010521

Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Local access

Highest impact Information disclosure

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Cleartext storage of sensitive information (CVE-ID: CVE-2021-21290)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insecure usage of temporary files in AbstractDiskHttpData method in Netty. The application stores sensitive information in temporary file that has insecure permissions. A local user can view application's temporary file and gain access to potentially sensitive data.

Remediation

Install update from vendor's website.

References

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-netty-affects-ibm-cloud-private-cve-2021-21290/"
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-netty-affects-ibm-cloud-private-cve-2021-21290/</a>
https://www.ibm.com/support/pages/node/6538152