Multiple vulnerabilities in IBM i
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2021-31618 CVE-2020-13950 CVE-2019-17567 CVE-2021-30641 CVE-2021-33193 |
| CWE-ID | CWE-476 CWE-264 CWE-20 CWE-444 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
IBM i Operating systems & Components / Operating system |
| Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) NULL pointer dereference
EUVDB-ID: #VU53773
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-31618
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in mod_http2 in Apache HTTP server. A remote attacker can send specially crafted request to the server and perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM i: 7.2 - 7.4
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_i:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.4:*:*:*:*:*:*:*
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-http-server-affect-ibm-i-2/
https://www.ibm.com/support/pages/node/6492615
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) NULL pointer dereference
EUVDB-ID: #VU53778
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-13950
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in mod_proxy_http. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM i: 7.2 - 7.4
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_i:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.4:*:*:*:*:*:*:*
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-http-server-affect-ibm-i-2/
https://www.ibm.com/support/pages/node/6492615
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Security restrictions bypass
EUVDB-ID: #VU53780
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-17567
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to unspecified error within the mod_proxy_wstunnel and mod_proxy_http modules. If mod_proxy_wstunnel is configured on an URL that is not necessarily Upgraded by the origin server and is tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM i: 7.2 - 7.4
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_i:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.4:*:*:*:*:*:*:*
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-http-server-affect-ibm-i-2/
https://www.ibm.com/support/pages/node/6492615
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Input validation error
EUVDB-ID: #VU53774
Risk: Medium
CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-30641
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect parsing of Apache configuration files. An unexpected
Install update from vendor's website.
Vulnerable software versionsIBM i: 7.2 - 7.4
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_i:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.4:*:*:*:*:*:*:*
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-http-server-affect-ibm-i-2/
https://www.ibm.com/support/pages/node/6492615
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Inconsistent interpretation of HTTP requests
EUVDB-ID: #VU56474
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-33193
CWE-ID:
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to preform HTTP/2 request smuggling attacks.
The vulnerability exists due to improper validation of HTTP/2 requests in mod_proxy in Apache HTTP Server. A remote attacker can send a specially crafted HTTP/2 request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison web server cache and perform phishing attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM i: 7.2 - 7.4
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_i:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_i:7.4:*:*:*:*:*:*:*
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-apache-http-server-affect-ibm-i-2/
https://www.ibm.com/support/pages/node/6492615
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
