Security Bulletin: Due to use of PostgreSQL, IBM Robotic Process Automation with Automation Anywhere is vulnerable to data confidentiality (CVE-2021-32029)

Summary

There are vulnerabilities in the PostgreSQL used by IBM Robotic Process Automation with Automation Anywhere. This affects the IBM Robotic Process Automation with Automation Anywhere control room application.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by switching to Microsoft SQL Server or upgrading to IBM Robotic Process Automation with Automation Anywhere 19.0.

CVEID:CVE-2021-32029
**DESCRIPTION:**A flaw was found in PostgreSQL. Using an UPDATE … RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.
CVSS Base score: 6.5
CVSS Temporal Score: See: <https://exchange.xforce.ibmcloud.com/vulnerabilities/207909&gt; for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Workarounds and Mitigations

None