Security Bulletin: Security vulnerabilities have been fixed in IBM Security Access Manager and IBM Security Verify Access (CVE-2020-4661, CVE-2020-4699, CVE-2020-4660)

Summary

Several security vulneraabilties have been fixed in both IBM Security Access Manager and IBM Security Verify Access products.

Vulnerability Details

CVEID:CVE-2020-4661
**DESCRIPTION:**IBM Security Access Manager Appliance could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/186142 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2020-4699
**DESCRIPTION:**IBM Security Access Manager Appliance could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/186947 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2020-4660
**DESCRIPTION:**IBM Security Access Manager Appliance could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/186140 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Fix Central

Docker

Log into docker.com and then execute the corresponding command for the release

ISAM 9.0.7.2 - docker pull ibmcom/isam:9.0.7.2

ISVA 10.0.0.1 - docker pull ibmcom/verify-access:10.0.0.1

AWS Marketplace

Workarounds and Mitigations

None