SB2022092210 - Multiple vulnerabilities in IBM Security Guardium

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: CVE-2021-29773)

The vulnerability allows a remote user to obtain sensitive information or modify user details.

The vulnerability exists in IBM Security Guardium. A remote user can trigger the vulnerability to obtain sensitive information or modify user details.

2) Code Injection (CVE-ID: CVE-2021-2161)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the java.lang.ProcessBuilder API on the Windows platform. A remote attacker can manipulate the Process command line and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-the-following-vulnerabilities-cve-2021-29773-cve-2021-2161/"
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-the-following-vulnerabilities-cve-2021-29773-cve-2021-2161/</a><br>
• https://www.ibm.com/support/pages/node/6488943<br><br></p>