In einer Zusammenfassung haben wir die Meldungen mit den CVSS Basis Score ab Stufe 7 aufgelistet.
Die Links zu allen am 12.11.2025 veröffentlichten IBM FLASH: Security Bulletins finden Sie am Ende dieses Beitrags.
IBM Storage Protect Operations Center is vulnerable to improper access control and stack overflow due to IBM SDK, Java (CVE-2025-21587, CVE-2025-30698, CVE-2025-4447).Zusammenfassung
IBM SDK, Java ist anfällig für unsachgemäße Zugriffskontrolle und Speicherüberlauf (stack overflow). IBM Storage Protect Operations Center verwendet IBM SDK, Java und ist möglicherweise von dieser Sicherheitslücke betroffen.
CVEID: CVE-2025-21587
DESCRIPTION: An unspecified vulnerability in Java SE related to the Server: DDL component could allow a remote attacker to cause high confidentiality and high integrity impact.
CWE: CWE-284: Improper Access Control
CVSS Source: secalert_us@oracle.com
CVSS Base score: 7.4
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2025-4447
DESCRIPTION: In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts.
CWE: CWE-121: Stack-based Buffer Overflow
CVSS Source: NVD
CVSS Base score: 7.8
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
IBM Storage Protect Affected Versions: 8.1.0.000 - 8.1.27.xxx
Fixing Level: 8.1.27.100
Security Bulletin: IBM Storage Protect Server is vulnerable to unauthenticated attacker with network access via multiple protocols and TLS due to IBM SDK, Java (CVE-2025-50106, CVE-2025-30749, CVE-2025-30761, CVE-2025-30754)Zusammenfassung
IBM SDK, Java ist anfällig für nicht authentifizierte Angreifer mit Netzwerkzugriff über mehrere Protokolle und TLS. IBM Storage Protect Server verwendet IBM SDK, Java und ist möglicherweise von dieser Sicherheitslücke betroffen.
CVEID: CVE-2025-50106
DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Source: secalert_us@oracle.com
CVSS Base score: 8.1
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2025-30749
DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Source: secalert_us@oracle.com
CVSS Base score: 8.1
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
IBM Storage Protect Affected Versions: 8.1.0.000 - 8.1.27.xxx
Fixing Level: 8.2 (Noch nicht verfügbar und soll Ende Quartal 4 2025 veröffentlicht werden.)
Security Bulletin: Denial of Service vulnerability in WebSphere Application Server Liberty affects IBM Storage Protect Operations Center (CVE-2025-36097)Zusammenfassung
IBM WebSphere Application Server Liberty ist anfällig für Denial-of-Service-Angriffe, die sich auf IBM Spectrum Protect (ehemals Tivoli Storage Manager) Operations Center auswirken können.
CVEID: CVE-2025-36097
DESCRIPTION: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume excessive memory resources.
CWE: CWE-121: Stack-based Buffer Overflow
CVSS Source: IBM
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
IBM Storage Protect Affected Versions: 8.1.0.000 - 8.1.27.xxx
Fixing Level: 8.1.27.100
Security Bulletin: DoS vulnerability in Apache Commons FileUpload vulnerability in WebSphere Application Server Liberty affects IBM Storage Protect Operations Center (CVE-2025-48976)Zusammenfassung
IBM WebSphere Application Server Liberty ist anfällig für DoS-Angriffe in Apache Commons FileUpload, die sich auf IBM Spectrum Protect (ehemals Tivoli Storage Manager) Operations Center auswirken können.
CVEID: CVE-2025-48976
DESCRIPTION: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
CVSS Source: CISA ADP
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
IBM Storage Protect Affected Versions: 8.1.0.000 - 8.1.27.xxx
Fixing Level: 8.1.27.100
Security Bulletin: IBM Storage Protect Server is susceptible to a vulnerability due to Golang crypto library.Zusammenfassung
Die Golang-Kryptobibliothek wird vom IBM Storage Protect Server Object Agent und der OSSM-Komponente verwendet. Golang Crypto ist anfällig für Denial-of-Service-Angriffe. In diesem Bulletin werden die Schritte zur Behebung der Sicherheitslücken beschrieben. CVE-2025-22869.
CVEID: CVE-2025-22869
DESCRIPTION: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
CVSS Source: CISA ADP
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
IBM Storage Protect Affected Versions: 8.1.0.000 - 8.1.27.xxx
Fixing Level: 8.1.27.100
Security Bulletin: IBM Storage Protect Server is susceptible to a vulnerability due to Golang coredns libraryZusammenfassung
Die Golang-coredns-Bibliothek wird vom IBM Storage Protect Server Object Agent und der OSSM-Komponente verwendet. Golang coredns ist anfällig für Denial-of-Service-Angriffe. In diesem Bulletin werden die Schritte zur Behebung der Sicherheitslücken beschrieben. CVE-2025-47950.
CVEID: CVE-2025-47950
DESCRIPTION: CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://` block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage, and/or monitor QUIC connection patterns and alert on anomalies.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
CVSS Source: security-advisories@github.com
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
IBM Storage Protect Affected Versions: 8.1.0.000 - 8.1.27.xxx
Fixing Level: 8.1.27.100
Hier geht es zum gesamten Beitrag mit Link-Liste
Sie haben Rückfragen zu IBM Storage Protect oder den Security Bulletins? Schreiben Sie mir gerne eine Mail.
Andreas Schwab, Senior Consultant
Telefon +49 171 954 86 44
Empalis-Team
