Fixed reported problems

Review the list of fixed problems to see whether your reported problem was fixed in the release or within a fix pack.

There are two fix pack versions available, 3.2.1.x fix packs and 3.2.2.x fix packs.

• The 3.2.1.x fix packs are intended for environments that include Kubernetes version 1.13.12.
• The 3.2.2.x fix packs include fixes to upgrade the supported version of Kubernetes. The fixes that are included within these 3.2.2.x fix packs include all fixes that are included within the equivalent 3.2.1.x fix pack, except for Kubernetes specific fixes.

If you apply a 3.2.2.x fix pack, do not apply an equivalent 3.2.1.x fix pack.

The latest 3.2.1.x fix pack is 3.2.1.2203. The latest 3.2.2.x fix pack is 3.2.2.2203 and upgrades Kubernetes to version 1.19.3.

The changes for fixed problems are included within the following fix packs and releases:

• IBM Cloud Private 3.2.2.2203 fix pack
• IBM Cloud Private 3.2.2.2105 fix pack
• IBM Cloud Private 3.2.2.2012 fix pack
• IBM Cloud Private 3.2.2.2008 fix pack
• IBM Cloud Private 3.2.2.2006 fix pack
• IBM Cloud Private 3.2.1.2203 fix pack
• IBM Cloud Private 3.2.1.2105 fix pack
• IBM Cloud Private 3.2.1.2012 fix pack
• IBM Cloud Private 3.2.1.2008 fix pack
• IBM Cloud Private 3.2.1.2006 fix pack
• IBM Cloud Private 3.2.1.2003 fix pack
• IBM Cloud Private 3.2.1.2001 fix pack
• IBM Cloud Private 3.2.1.1911 fix pack
• IBM Cloud Private 3.2.1.1910 fix pack
• IBM Cloud Private 3.2.1

For more information about how to apply fixes to your cluster, see Applying fix packs to your cluster.

Note: If you do want to apply, or upgrade to, a 3.2.2.x fix pack, you must first install or upgrade to the 3.2.1.2003 or newer 3.2.1.x fix pack. After you apply the 3.2.1.2003 or newer 3.2.1.x fix pack version, you can repeat the same steps and apply the 3.2.2.2006 or 3.2.2.2008 fix pack to upgrade Kubernetes to version 1.16.7. To download and upgrade to the 3.2.2.2203 fix pack from the 3.2.2.2008 or 3.2.2.2006 fix pack, you need to follow the procedure for upgrading to IBM Cloud Private 3.2.1, but use the package and commands to upgrade to 3.2.2.2203. For more information, see Upgrading.

Reported problems that are fixed in the IBM Cloud Private 3.2.2.2203 fix pack

The fixes included within this 3.2.2.2203 fix pack includes all fixes that are included within the 3.2.2.2203 fix pack that do not apply to the updated version of Kubernetes of the 3.2.2.2203 fix pack. The 3.2.2.2203 fix pack is intended for applying fixes to environments that use the 1.13.12 version of Kubernetes. If you apply the 3.2.2.2203 fix pack to upgrade the supported Kubernetes version, do not apply the 3.2.2.2203 fix pack. If you need to upgrade the supported Kubernetes version, you must apply the 3.2.2.2203 fix pack instead of this 3.2.2.2203 fix pack.

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.2.2203

Fixed security-related vulnerabilities in 3.2.2.2203

The 3.2.2.2203 fix pack is cumulative and includes all fixes that were included in previous 3.2.2.x fix packs for IBM Cloud Private 3.2.2.

Updated images in 3.2.2.2203

Updated charts in 3.2.2.2203

Reported problems that are fixed in the IBM Cloud Private 3.2.2.2105 fix pack

The fixes included within this 3.2.2.2105 fix pack includes all fixes that are included within the 3.2.2.2105 fix pack that do not apply to the updated version of Kubernetes of the 3.2.2.2105 fix pack. The 3.2.2.2105 fix pack is intended for applying fixes to environments that use the 1.13.12 version of Kubernetes. If you apply the 3.2.2.2105 fix pack to upgrade the supported Kuberenetes version, do not apply the 3.2.2.2105 fix pack. If you need to upgrade the supported Kubernetes version, you must apply the 3.2.2.2105 fix pack instead of this 3.2.2.2105 fix pack.

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.2.2105

Fixed security-related vulnerabilities in 3.2.2.2105

Table: Fixed security vulnerabilities in fix pack 3.2.2.2105

Issue	CVE-ID	Description
34823 34860	CVE-2019-1551	OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By performing a man-in-the-middle attack, a remote attacker could exploit this vulnerability to obtain sensitive information.
44229 44243 44356 44515 45537	CVE-2020-1971	OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERAL_NAME_cmp function contain an EDIPARTYNAME, an attacker could exploit this vulnerability to cause the application to crash.
41419 41807	CVE-2020-1968	OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite, an attacker could exploit this vulnerability to eavesdrop on all encrypted communications sent over that TLS connection.
44504 44552	CVE-2020-2773	An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
46131 46243	CVE-2020-5258	Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this vulnerability to overwrite, or pollute, a JavaScript application object prototype of the base object.
40047 40238	CVE-2020-7016	Elastic Kibana is vulnerable to a denial of service, caused by a vulnerability in Timelion. By persuading a victim to visit a specially crafted URL, a remote attacker could exploit this vulnerability to consume all available CPU resources.
40047 40238	CVE-2020-7017	Elastic Kibana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by region map visualization. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
40502 41427	CVE-2020-7018	Elastic Enterprise Search could allow a remote authenticated attacker to obtain sensitive information, caused by a credential exposure flaw in the App Search interface. By sending a request with a specially crafted role, a remote attacker could exploit this vulnerability to view the administrator API credentials.
40502 41427	CVE-2020-7019	Elasticsearch could allow a remote authenticated attacker to obtain sensitive information, caused by a field disclosure flaw when running a scrolling search. By running the same query, an attacker could exploit this vulnerability to obtain sensitive information.
42340 42925	CVE-2020-7020	Elastic Enterprise Search could allow a remote authenticated attacker to obtain sensitive information, caused by not properly preserving security permissions in search queries. By sending a search request, a remote attacker could exploit this vulnerability to disclose the existence of documents.
46403 46517	CVE-2020-7924	MongoDB Database Tools could allow a remote attacker to bypass security restrictions, caused by a flaw in the usage of specific command line parameter. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass certificate validation.
44229 44243 44356 44515 45537	CVE-2020-8265	Node.js is vulnerable to a denial of service, caused by a use-after-free in TLSWrap within the TLS implementation. By writing to a TLS enabled socket, an attacker could exploit this vulnerability to corrupt memory and cause a denial of service.
44229 44243 44356 44515 45537	CVE-2020-8287	Node.js is vulnerable to HTTP request smuggling. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
43172 43605	CVE-2020-8554	Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when using LoadBalancer or ExternalIPs. By using man-in-the-middle attack techniques, an attacker could exploit this vulnerability to patch the status of a LoadBalancer service.
44013 44534	CVE-2020-8567	Kubernetes Secrets Store CSI Driver for Vault Plugin, Azure Plugin, and GCP Plugin could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially-crafted SecretProviderClass objects containing "dot dot" sequences (/../) to write arbitrary files on the system.
44013 44534	CVE-2020-8568	Kubernetes Secrets Store CSI Driver could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially-crafted request containing "dot dot" sequences (/../) to write content to the host filesystem and sync file contents to Kubernetes Secrets.
44013 44534	CVE-2020-8569	Kubernetes CSI snapshot-controller is vulnerable to a denial of service, caused by a NULL pointer dereference flaw when processing a VolumeSnapshot custom resource. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause the application to crash.
40043 40086	CVE-2020-14039	Go could allow a remote attacker to bypass security restrictions, caused by improper validation on the VerifyOptions.KeyUsages EKU requirements during the X.509 certificate verification. An attacker could exploit this vulnerability to gain access to the system.
44042 44182	CVE-2020-14781	An unspecified vulnerability in Java SE, Java SE Embedded related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
40043 40086 40275 44431	CVE-2020-15586	Go is vulnerable to a denial of service, caused by a data race in some net/http servers. By sending specially-crafted HTTP requests, a remote attacker could exploit this vulnerability to cause a denial of service condition.
41425 41808	CVE-2020-24750	FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization between gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. By sending specially-crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
43171 43301	CVE-2020-25649	FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly. A remote attacker could exploit this vulnerability to launch XML external entity (XXE) attacks to have impact over data integrity.
42922 42966 44431	CVE-2020-28362	Golang Go is vulnerable to a denial of service, caused by improper input validation by the math/big.Int methods. By sending a specially-crafted inputs, a remote attacker could exploit this vulnerability to cause the application to crash.
42922 42966 44431	CVE-2020-28366	Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by a code injection flaw in go command when cgo is in use in build time. By using a specially-crafted package, an attacker could exploit this vulnerability to execute arbitrary code on the system.
42922 42966 44431	CVE-2020-28367	Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by an argument injection flaw in go command when cgo is in use in build time. By using a specially-crafted package, an attacker could exploit this vulnerability to execute arbitrary code on the system.
44661 44663 44836 45346 45369	CVE-2020-28500	Node.js lodash module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) in the toNumber, trim and trimEnd functions. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
43626 43808	CVE-2020-28851	Golang Go is vulnerable to a denial of service, caused by improper input validation while parsing the -u- extension in language.ParseAcceptLanguage. By sending a specially-crafted HTTP Accept-Language header, a remote attacker could exploit this vulnerability to cause an index out of range panic.
43626 43808	CVE-2020-28852	Golang Go is vulnerable to a denial of service, caused by improper input validation while processing a BCP 47 tag in language.ParseAcceptLanguage. By sending a specially-crafted HTTP Accept-Language header, a remote attacker could exploit this vulnerability to cause a slice bounds out of range panic.
44183 44234 44279 44357 44431	CVE-2021-3114	An unspecified error with the P224() Curve implementation can generate incorrect outputs in Golang Go has an unknown impact and attack vector.
44183 44234 44279 44357 44431	CVE-2021-3115	Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by a command injection flaw when using the go get command to fetch modules that make use of cgo. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
43714 43939 43807 44330 44431	CVE-2021-3121	An unspecified error with the lack of certain index validation, also known as the "skippy peanut butter" issue in GoGo Protobuf has an unknown impact and attack vector.
45535 45543 45970 46130	CVE-2021-3449	OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signature_algorithms processing. By sending a specially crafted renegotiation ClientHello message from a client, a remote attacker could exploit this vulnerability to cause the TLS server to crash.
45535 45543 45970 46130	CVE-2021-3450	OpenSSL could allow a remote attacker to bypass security restrictions, caused by a a missing check in the validation logic of X.509 certificate chains by the X509_V_FLAG_X509_STRICT flag. By using any valid certificate or certificate chain to sign a specially crafted certificate, an attacker could bypass the check that non-CA certificates must not be able to issue other certificates and override the default purpose.
44660 44834	CVE-2021-7021	Elasticsearch could allow a local authenticated attacker to obtain sensitive information, caused by an error when audit logging and the emit_request_body option is enabled. By opening the audit log, a local authenticated attacker could obtain password hashes or authentication tokens and use this information to launch further attacks against the affected system.
46682 46906	CVE-2021-20228	Ansible Engine could allow a local authenticated attacker to obtain sensitive information, caused by sensitive info is not masked or not protected by the no_log feature by default. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
46403 46517	CVE-2021-20334	MongoDB Compass for Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper access control. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to execute arbitrary with the privileges of the user.
44470 44475	CVE-2021-21303	Helm could allow a local authenticated attacker to bypass security restrictions, caused by the failure to sanitized multiple fields in various .yaml files. By sending a specially-crafted request, an attacker could exploit this vulnerability to send deceptive, obscure or alter information to a terminal screen.
44860 45539	CVE-2021-22883	Node.js is vulnerable to a denial of service, caused by a file descriptor leak. By making multiple attempts to connect with an 'unknownProtocol', an attacker could exploit this vulnerability to lead to an excessive memory usage and cause the system to run out of memory.
44860 45200 45539	CVE-2021-22884	Node.js is vulnerable to a denial of service, caused by an error when the whitelist includes "localhost6". By controlling the victim's DNS server or spoofing its responses, an attacker could exploit this vulnerability to bypass the DNS rebinding protection mechanism using the "localhost6" domain and cause a denial of service.
44611 44662 44752 45349 45370 46572	CVE-2021-23337	All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Command Injection via template.
44613 44667 44668	CVE-2021-23839	OpenSSL could provide weaker than expected security, caused by incorrect SSLv2 rollback protection that allows for the inversion of the logic during a padding check. If the server is configured for SSLv2 support at compile time, configured for SSLv2 support at runtime or configured for SSLv2 ciphersuites, it will accept a connection if a version rollback attack has occurred and erroneously reject a connection if a normal SSLv2 connection attempt is made.
44613 44667 44668 44860 45200 45539	CVE-2021-23840	OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could exploit this vulnerability to cause the application to crash.
44613 44667 44668	CVE-2021-23841	OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in the X509_issuer_and_serial_hash() function. By parsing the issuer field, an attacker could exploit this vulnerability to cause the application to crash.
46176 46516	CVE-2021-25735	Kubernetes kube-apiserver could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when performing note updates. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass a Validating Admission Webhook.
46011 46129	CVE-2021-26296	Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
45159 45216 45335	CVE-2021-27918	Golang Go is vulnerable to a denial of service, caused by an infinite loop flaw when using xml.NewTokenDecoder with a custom TokenReader. By persuading a victim to open a specially-crafted XML content, a remote attacker could exploit this vulnerability to cause a denial of service condition.
45159 45216 46335	CVE-2021-27919	Golang Go is vulnerable to a denial of service, caused by a flaw in the Reader.Open API when use a ZIP archive containing files start with ../. By persuading a victim to open a specially-crafted ZIP archive, a remote attacker could exploit this vulnerability to cause a denial of service condition.
44953 44966	CVE-2021-28041	OpenSSH ssh-agent could allow a remote attacker to bypass security restrictions, caused by a double free flaw. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to arbitrary hosts.

The 3.2.2.2105 fix pack is cumulative and includes all fixes that were included in previous 3.2.2.x fix packs for IBM Cloud Private 3.2.2.

Updated images in 3.2.2.2105

Updated charts in 3.2.2.2105

Reported problems that are fixed in the IBM Cloud Private 3.2.2.2012 fix pack

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.2.2012

Fixed security-related vulnerabilities in 3.2.2.2012

Table: Fixed security vulnerabilities in fix pack 3.2.2.2012

Issue	CVE-ID	Description
34823	CVE-2019-1551	OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By performing a man-in-the-middle attack, a remote attacker could exploit this vulnerability to obtain sensitive information.
38874 42039	CVE-2020-8203	Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the server and possibly execute arbitrary code on the system.
40561	CVE-2020-7923	MongoDB is vulnerable to a denial of service, caused by a flaw in geoNear invariant. By sending specially crafted queries, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
41426	CVE-2020-15187	Helm could allow a remote authenticated attacker to bypass security restrictions, caused by an issue with containing duplicates of the same entry in the plugin.yaml file. By sending a specially-crafted input, an attacker could exploit this vulnerability to modify a plugin's install hooks to perform a local execution attack.
41426	CVE-2020-15186	Helm could allow a remote attacker to bypass security restrictions, caused by improper input valuation by the plugin names. By sending a specially-crafted input, an attacker could exploit this vulnerability to duplicate the name of another plugin or spoofing the output to helm --help.
41426	CVE-2020-15185	Helm could allow a remote authenticated attacker to bypass security restrictions, caused by an issue with allowing duplicates of the same chart entry in the repository index file. By sending a specially-crafted input, an attacker could exploit this vulnerability to inject a bad chart into a repository.
41426	CVE-2020-15184	Helm could allow a remote attacker to bypass security restrictions, caused by improper input valuation by the alias field on a Chart.yaml. By sending a specially-crafted input, an attacker could exploit this vulnerability to inject unwanted information into a chart.
41614	CVE-2020-8252	Node.js is vulnerable to a buffer overflow, caused by improper bounds checking by the libuv's fs.realpath.native.
40043	CVE-2020-15586	Go is vulnerable to a denial of service, caused by a data race in some net/http servers. By sending specially-crafted HTTP requests, a remote attacker could exploit this vulnerability to cause a denial of service condition.
40043	CVE-2020-14039	Go could allow a remote attacker to bypass security restrictions, caused by improper validation on the VerifyOptions.KeyUsages EKU requirements during the X.509 certificate verification. An attacker could exploit this vulnerability to gain access to the system.
40347 42039	CVE-2020-16845	Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary.
41424 42039	CVE-2020-4590	IBM WebSphere Application Server Liberty running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of service attack conducted by an authenticated client.
43169	CVE-2020-25659	python-cryptography could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timing attack.
39032	CVE-2020-8169	cURL libcurl could allow a remote attacker to obtain sensitive information, caused by the failure to correctly URL encode the credential data when set using an curl_easy_setopt option. The host name and partial password is leaked in cleartext over DNS on HTTP redirect. An attacker could exploit this vulnerability to obtain sensitive information.
39032	CVE-2020-8177	cURL could allow a remote attacker to overwrite arbitrary files on the system, caused by the improper handling of certain parameters when using -J (--remote-header-name) and -I (--include) in the same command line. An attacker could exploit this vulnerability to overwrite a local file.
42920	CVE-2020-14792	An unspecified vulnerability in related to the component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and no availability impact.
42920	CVE-2020-14797	An unspecified vulnerability in Java SE, Java SE Embedded related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
42920	CVE-2020-14781	An unspecified vulnerability in Java SE, Java SE Embedded related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
42920	CVE-2020-14779	An unspecified vulnerability in Java SE, Java SE Embedded related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
42920	CVE-2020-14798	An unspecified vulnerability in Java SE, Java SE Embedded related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
42920	CVE-2020-14796	An unspecified vulnerability in Java SE, Java SE Embedded related to the Libraries component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
42921	CVE-2020-14782	An unspecified vulnerability in Java SE, Java SE Embedded related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.

The 3.2.2.2012 fix pack is cumulative and includes all fixes that were included in previous 3.2.2.x fix packs and previous 3.2.1.x fix packs for IBM Cloud Private 3.2.1 up to the 3.2.1.2003 fix pack.

Updated images in 3.2.2.2012

Note: Images that include the suffix -oss (icp-elasticsearch-oss, icp-filebeat-oss, icp-kibana-oss, icp-logstash-oss) are newer versions of images that did not include the suffix. For example, icp-elasticsearch-oss is the replacement for the icp-elasticsearch image, which is now deprecated.

Updated charts in 3.2.2.2012

Reported problems that are fixed in the IBM Cloud Private 3.2.2.2008 fix pack

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.2.2008

Fixed security-related vulnerabilities in 3.2.2.2008

Table: Fixed security vulnerabilities in fix pack 3.2.2.2008

Issue	CVE-ID	Description
31863	CVE-2019-1547	OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC group missing the cofactor using explicit parameters instead of using a named curve. An attacker could exploit this vulnerability to obtain full key recovery during an ECDSA signature operation.
31863	CVE-2019-1549	OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to include protection in the event of a fork() system call to ensure that the parent and child processes do not share the same RNG state. An attacker could exploit this vulnerability to obtain sensitive information.
35166 35312	CVE-2019-1551	OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By re-using the DH512 private key, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
31863	CVE-2019-1563	OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7_dataDecode and CMS_decrypt_set1_pkey. By sending an overly large number of messages to be decrypted, an attacker could exploit this vulnerability to obtain sensitive information.
35476	CVE-2020-7238	Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
34244	CVE-2019-7620	Elastic Logstash is vulnerable to a denial of service, caused by a flaw in the Beats input plugin. By sending a specially-crafted network packet, a remote attacker could exploit this vulnerability to cause the application to stop responding. Upgrade to the latest version of Logstash (6.8.4, 7.4.1 or later), available from the Elastic Web site.
37619	CVE-2019-11612	The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
35851	CVE-2019-15604	Node.js is vulnerable to a denial of service, caused by improper certificate validation. By sending a specially-crafted X.509 certificate, a remote attacker could exploit this vulnerability to cause the process to abort.
35851	CVE-2019-15605	Node.js vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
35851	CVE-2019-15606	Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have trailing OWS trimmed. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authorization based on header value comparisons.
38548	CVE-2020-7012	Elastic Kibana could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the Upgrade Assistant. By sending a specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code in the context of Kibana process on the host system.
38548	CVE-2020-7013	Elastic Kibana could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in TSVB . By sending a specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code in the context of Kibana process on the host system.
38548	CVE-2020-7015	Elastic Kibana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input in TSVB visualization. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
39076	CVE-2020-7614	Elastic Elasticsearch could allow a remote authenticated attacker to obtain sensitive information, caused by a race condition in the response headers. By sending specially-crafted requests, an attacker could exploit this vulnerability to obtain sensitive information of another user from the response header.
37996	CVE-2020-7921	MongoDB Server could allow a remote authenticated attacker to bypass security restrictions, caused by improper serialization of internal state in the authorization subsystem. An attacker could exploit this vulnerability to bypass IP whitelisting protection.
39032	CVE-2020-8169	cURL libcurl could allow a remote attacker to obtain sensitive information, caused by the failure to correctly URL encode the credential data when set using an curl_easy_setopt option. The host name and partial password is leaked in cleartext over DNS on HTTP redirect. An attacker could exploit this vulnerability to obtain sensitive information.
39032 39067	CVE-2020-8177	curl could allow a remote attacker to overwrite arbitrary files on the system, caused by the improper handling of certain parameters when using -J (--remote-header-name) and -I (--include) in the same command line. An attacker could exploit this vulnerability to overwrite a local file.
38874	CVE-2020-8203	Fixed for the Metering component only. Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the server and possibly execute arbitrary code on the system.
40048	CVE-2020-8553	Kubernetes ingress-nginx could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when the annotation nginx.ingress.kubernetes.io/auth-type: basic is used. By sending a specially crafted request, an attacker could exploit this vulnerability to create a new Ingress definition and replace the password file.
39624	CVE-2020-8557	Kubernetes kubelet is vulnerable to a denial of service, caused by an issue with not including the /etc/hostsfile file by the kubelet eviction manager when calculating ephemeral storage usage. By writing a large amount of data to the /etc/hostsfile, a local authenticated attacker could exploit this vulnerability to fill the storage space of the node and cause the node to fail.
39624	CVE-2020-8559	Kubernetes kube-apiserver could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw when multiple clusters share the same certificate authority trusted by the client. By intercepting certain requests and sending a redirect response, an attacker could exploit this vulnerability to compromise other nodes.
38544	CVE-2020-13401	Docker Docker CE is vulnerable to a man-in-the-middle attack, caused by improper validation of router advertisements. By sending rogue router advertisements, an attacker could exploit this vulnerability using man-in-the-middle techniques to gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
39229	CVE-2020-13597	Clusters using Calico (version 3.14.0 and earlier), Calico Enterprise (version 2.8.2 and earlier), can be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege can reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default. This vulnerability allows an attacker to redirect full or partial network traffic from the node to the compromised pod.
39222	CVE-2020-14422	Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.

The 3.2.2.2008 fix pack is cumulative and includes all fixes that were included in the 3.2.2.2006 fix pack and the previous 3.2.1.x fix packs for IBM Cloud Private 3.2.1 up to the 3.2.1.2003 fix pack.

Updated images in 3.2.2.2008

Note: Images that include the suffix -oss (icp-elasticsearch-oss, icp-filebeat-oss, icp-kibana-oss, icp-logstash-oss) are newer versions of images that did not include the suffix. For example, icp-elasticsearch-oss is the replacement for the icp-elasticsearch image, which is now deprecated.

Updated charts in 3.2.2.2008

Reported problems that are fixed in the IBM Cloud Private 3.2.2.2006 fix pack

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.2.2006

Fixed security-related vulnerabilities in 3.2.2.2006

Table: Fixed security vulnerabilities in fix pack 3.2.2.2006

Issue	CVE-ID	Description
38572 38573	CVE-2018-1002102	Kubernetes API server could allow a remote authenticated attacker to conduct phishing attacks, caused by an improper validation of URL redirection. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a victim to arbitrary Web sites.
34823 34859	CVE-2019-1551	OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By re-using the DH512 private key, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
31863 32149	CVE-2019-1547	OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC group missing the co-factor using explicit parameters instead of using a named curve. An attacker could exploit this vulnerability to obtain full key recovery during an ECDSA signature operation.
31863 32149	CVE-2019-1549	OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to include protection in the event of a fork() system call to ensure that the parent and child processes do not share the same RNG state. An attacker could exploit this vulnerability to obtain sensitive information.
31863 32149	CVE-2019-1563	OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7_dataDecode and CMS_decrypt_set1_pkey. By sending an overly large number of messages to be decrypted, an attacker could exploit this vulnerability to obtain sensitive information.
31866 32151	CVE-2019-5481	cURL libcurl is vulnerable to a denial of service, caused by a double free flaw during kerberos FTP data transfer. By sending a specially-crafted size of data, a remote attacker could exploit this vulnerability to cause a denial of service condition.
31866	CVE-2019-5482	cURL libcurl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the tftp_receive_packet function. By sending specially-crafted request containing an OACK without the BLKSIZE option, a remote attacker could overflow a buffer and execute arbitrary code on the system.
32678 23646	CVE-2019-9947	Python is vulnerable to HTTP header injection, caused by improper validation of input in urllib and urllib2. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
32678 23646	CVE-2019-9948	Python could allow a remote attacker to bypass security restrictions, caused by improper input validation by the urllib. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass the blacklist file: URIs protection mechanisms.
35851 35877 35928 35952 35953 36565 36566 37944	CVE-2019-15604	Node.js is vulnerable to a denial of service, caused by improper certificate validation. By sending a specially-crafted X.509 certificate, a remote attacker could exploit this vulnerability to cause the process to abort.
35851 35877 35928 35952 35953 36565 36566 37944	CVE-2019-15605	Node.js vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
35851 35877 35928 35952 35953 36565 36566 37944	CVE-2019-15606	Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have trailing OWS trimmed. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authorization based on header value comparisons.
32777 32933	CVE-2019-16935	Python is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the python/Lib/DocXMLRPCServer.py. A remote attacker could exploit this vulnerability using the server_title field to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
36569 36587	CVE-2019-17573	Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
37835 37846	CVE-2020-2754	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2755	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2756	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2757	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2781	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2800	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
37835 37846	CVE-2020-2803	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).
37835 37846	CVE-2020-2805	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).
37835 37846	CVE-2020-2830	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
36802 36817	CVE-2020-4303	IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
36802 36817	CVE-2020-4304	IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
37620 37648	CVE-2020-4329	IBM WebSphere Application Server could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to conduct spoofing attacks.
37833 37844	CVE-2020-4421	IBM WebSphere Application Liberty could allow an authenticated user using openidconnect to spoof another users identify.
38545 38647 38649 38650	CVE-2020-8172	Node.js could allow a remote attacker to bypass security restrictions. The 'session' event could be emitted before the 'secureConnect' event and possibly allow for the reuse of the TLS session. An attacker could exploit this vulnerability to bypass host certificate verification and gain access to the system.
38545 38647 38649 38650	CVE-2020-8174	Node.js is vulnerable to a buffer overflow, caused by multiple memory corruptions in the napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16() functions. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
38545 38647 38649 38650	CVE-2020-10531	International Components for Unicode (ICU) for C/C++ is vulnerable to a heap-based buffer overflow, caused by an integer overflow in UnicodeString::doAppend() function in common/unistr.cpp. By sending a specially-crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
38545 38647 38649 38650	CVE-2020-11080	Node.js is vulnerable to a denial of service, caused by an error in the HTTP/2 session frame which is limited to 32 settings by default. By sending overly large HTTP/2 SETTINGS frames, an attacker could exploit this vulnerability to consume all available CPU resources.
36896 36961	CVE-2020-11254	Kubernetes is vulnerable to a denial of service, caused by a flaw in kube-apiserver. By sending a specially-crafted request using YAML payloads, a remote authenticated attacker could exploit this vulnerability to consume excessive CPU cycles.

Updated images in 3.2.2.2006

Updated charts in 3.2.2.2006

Reported problems that are fixed in the IBM Cloud Private 3.2.1.2203 fix pack

The fixes included within this 3.2.1.2203 fix pack includes all fixes that are included within the 3.2.1.2203 fix pack that do not apply to the updated version of Kubernetes of the 3.2.1.2203 fix pack. The 3.2.2.2105 fix pack is intended for applying fixes to environments that use the 1.13.12 version of Kubernetes. If you apply the 3.2.1.2203 fix pack to upgrade the supported Kuberenetes version, do not apply the 3.2.1.2203 fix pack. If you need to upgrade the supported Kubernetes version, you must apply the 3.2.1.2203 fix pack instead of this 3.2.1.2203 fix pack.

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.1.2203

Fixed security-related vulnerabilities in 3.2.1.2203

The 3.2.1.2203 fix pack is cumulative and includes all fixes that were included in previous 3.2.1.x fix packs for IBM Cloud Private 3.2.1.

Updated images in 3.2.1.2203

Updated charts in 3.2.1.2203

Reported problems that are fixed in the IBM Cloud Private 3.2.1.2105 fix pack

The fixes included within this 3.2.1.2105 fix pack includes all fixes that are included within the 3.2.2.2105 fix pack that do not apply to the updated version of Kubernetes of the 3.2.2.2105 fix pack. The 3.2.1.2105 fix pack is intended for applying fixes to environments that use the 1.13.12 version of Kubernetes. If you apply the 3.2.2.2105 fix pack to upgrade the supported Kuberenetes version, do not apply the 3.2.1.2105 fix pack. If you need to upgrade the supported Kubernetes version, you must apply the 3.2.2.2105 fix pack instead of this 3.2.1.2105 fix pack.

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.1.2105

Fixed security-related vulnerabilities in 3.2.1.2105

Table: Fixed security vulnerabilities in fix pack 3.2.1.2105

Issue	CVE-ID	Description
44229 44243 44356 44515 45537	CVE-2020-1971	OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERAL_NAME_cmp function contain an EDIPARTYNAME, an attacker could exploit this vulnerability to cause the application to crash.
44552 44504	CVE-2020-2773	An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
46131 46243	CVE-2020-5258	Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this vulnerability to overwrite, or pollute, a JavaScript application object prototype of the base object.
46403 46517	CVE-2020-7924	MongoDB Database Tools could allow a remote attacker to bypass security restrictions, caused by a flaw in the usage of specific command line parameter. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass certificate validation.
44229 44243 44356 44515 45537	CVE-2020-8265	Node.js is vulnerable to a denial of service, caused by a use-after-free in TLSWrap within the TLS implementation. By writing to a TLS enabled socket, an attacker could exploit this vulnerability to corrupt memory and cause a denial of service.
44229 44243 44356 44515 45537	CVE-2020-8287	Node.js is vulnerable to HTTP request smuggling. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
44013 44534	CVE-2020-8567	Kubernetes Secrets Store CSI Driver for Vault Plugin, Azure Plugin, and GCP Plugin could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially-crafted SecretProviderClass objects containing "dot dot" sequences (/../) to write arbitrary files on the system.
44013 44534	CVE-2020-8568	Kubernetes Secrets Store CSI Driver could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially-crafted request containing "dot dot" sequences (/../) to write content to the host filesystem and sync file contents to Kubernetes Secrets.
44013 44534	CVE-2020-8569	Kubernetes CSI snapshot-controller is vulnerable to a denial of service, caused by a NULL pointer dereference flaw when processing a VolumeSnapshot custom resource. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause the application to crash.
40043 40086	CVE-2020-14039	Go could allow a remote attacker to bypass security restrictions, caused by improper validation on the VerifyOptions.KeyUsages EKU requirements during the X.509 certificate verification. An attacker could exploit this vulnerability to gain access to the system.
44042 44182	CVE-2020-14781	An unspecified vulnerability in Java SE, Java SE Embedded related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
40043 40086	CVE-2020-15586	Go is vulnerable to a denial of service, caused by a data race in some net/http servers. By sending specially-crafted HTTP requests, a remote attacker could exploit this vulnerability to cause a denial of service condition.
40347	CVE-2020-16845	Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
42922 42966 44431	CVE-2020-28362	Golang Go is vulnerable to a denial of service, caused by improper input validation by the math/big.Int methods. By sending a specially-crafted inputs, a remote attacker could exploit this vulnerability to cause the application to crash.
42922 42966 44431	CVE-2020-28366	Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by a code injection flaw in go command when cgo is in use in build time. By using a specially-crafted package, an attacker could exploit this vulnerability to execute arbitrary code on the system.
42922 42966 44431	CVE-2020-28367	Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by an argument injection flaw in go command when cgo is in use in build time. By using a specially-crafted package, an attacker could exploit this vulnerability to execute arbitrary code on the system.
44661 45346	CVE-2020-28500	Node.js lodash module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) in the toNumber, trim and trimEnd functions. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
43626 43808	CVE-2020-28851	Golang Go is vulnerable to a denial of service, caused by improper input validation while parsing the -u- extension in language.ParseAcceptLanguage. By sending a specially-crafted HTTP Accept-Language header, a remote attacker could exploit this vulnerability to cause an index out of range panic.
43626 43808	CVE-2020-28852	Golang Go is vulnerable to a denial of service, caused by improper input validation while processing a BCP 47 tag in language.ParseAcceptLanguage. By sending a specially-crafted HTTP Accept-Language header, a remote attacker could exploit this vulnerability to cause a slice bounds out of range panic.
44183 44234 44279 44357 44431	CVE-2021-3114	An unspecified error with the P224() Curve implementation can generate incorrect outputs in Golang Go has an unknown impact and attack vector.
44183 44234 44279 44357 44431	CVE-2021-3115	Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by a command injection flaw when using the go get command to fetch modules that make use of cgo. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
43714 43939 43807 44330 44431	CVE-2021-3121	An unspecified error with the lack of certain index validation, also known as the "skippy peanut butter" issue in GoGo Protobuf has an unknown impact and attack vector.
45535 45970 46130	CVE-2021-3449	OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signature_algorithms processing. By sending a specially crafted renegotiation ClientHello message from a client, a remote attacker could exploit this vulnerability to cause the TLS server to crash.
45535 45970 46130	CVE-2021-3450	OpenSSL could allow a remote attacker to bypass security restrictions, caused by a a missing check in the validation logic of X.509 certificate chains by the X509_V_FLAG_X509_STRICT flag. By using any valid certificate or certificate chain to sign a specially crafted certificate, an attacker could bypass the check that non-CA certificates must not be able to issue other certificates and override the default purpose.
46682 46906	CVE-2021-20228	Ansible Engine could allow a local authenticated attacker to obtain sensitive information, caused by sensitive info is not masked or not protected by the no_log feature by default. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
46403 46517	CVE-2021-20334	MongoDB Compass for Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper access control. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to execute arbitrary with the privileges of the user.
44470 44475	CVE-2021-21303	Helm could allow a local authenticated attacker to bypass security restrictions, caused by the failure to sanitized multiple fields in various .yaml files. By sending a specially-crafted request, an attacker could exploit this vulnerability to send deceptive, obscure or alter information to a terminal screen.
44860 45539	CVE-2021-22883	Node.js is vulnerable to a denial of service, caused by a file descriptor leak. By making multiple attempts to connect with an 'unknownProtocol', an attacker could exploit this vulnerability to lead to an excessive memory usage and cause the system to run out of memory.
44860 45539	CVE-2021-22884	Node.js is vulnerable to a denial of service, caused by an error when the whitelist includes "localhost6". By controlling the victim's DNS server or spoofing its responses, an attacker could exploit this vulnerability to bypass the DNS rebinding protection mechanism using the "localhost6" domain and cause a denial of service.
44611 45349	CVE-2021-23337	All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Command Injection via template.
44860 45539	CVE-2021-23840	OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could exploit this vulnerability to cause the application to crash.
46011 46129	CVE-2021-26296	Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
45159 45335	CVE-2021-27918	Golang Go is vulnerable to a denial of service, caused by an infinite loop flaw when using xml.NewTokenDecoder with a custom TokenReader. By persuading a victim to open a specially-crafted XML content, a remote attacker could exploit this vulnerability to cause a denial of service condition.
45159 45335	CVE-2021-27919	Golang Go is vulnerable to a denial of service, caused by a flaw in the Reader.Open API when use a ZIP archive containing files start with ../. By persuading a victim to open a specially-crafted ZIP archive, a remote attacker could exploit this vulnerability to cause a denial of service condition.

The 3.2.1.2012 fix pack is cumulative and includes all fixes that were included in previous 3.2.1.x fix packs for IBM Cloud Private 3.2.1.

Updated images in 3.2.1.2105

Updated charts in 3.2.1.2105

Reported problems that are fixed in the IBM Cloud Private 3.2.1.2012 fix pack

The fixes included within this 3.2.1.2012 fix pack includes all fixes that are included within the 3.2.2.2012 fix pack that do not apply to the updated version of Kubernetes of the 3.2.2.2012 fix pack. The 3.2.1.2012 fix pack is intended for applying fixes to environments that use the 1.13.12 version of Kubernetes. If you apply the 3.2.2.2012 fix pack to upgrade the supported Kuberenetes version, do not apply the 3.2.1.2012 fix pack. If you need to upgrade the supported Kubernetes version, you must apply the 3.2.2.2012 fix pack instead of this 3.2.1.2012 fix pack.

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.1.2012

Fixed security-related vulnerabilities in 3.2.1.2012

Issue	CVE-ID	Description
34823	CVE-2019-1551	OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By performing a man-in-the-middle attack, a remote attacker could exploit this vulnerability to obtain sensitive information.
38874 42039	CVE-2020-8203	Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the server and possibly execute arbitrary code on the system.
41426	CVE-2020-15187	Helm could allow a remote authenticated attacker to bypass security restrictions, caused by an issue with containing duplicates of the same entry in the plugin.yaml file. By sending a specially-crafted input, an attacker could exploit this vulnerability to modify a plugin's install hooks to perform a local execution attack.
41426	CVE-2020-15186	Helm could allow a remote attacker to bypass security restrictions, caused by improper input valuation by the plugin names. By sending a specially-crafted input, an attacker could exploit this vulnerability to duplicate the name of another plugin or spoofing the output to helm --help.
41426	CVE-2020-15185	Helm could allow a remote authenticated attacker to bypass security restrictions, caused by an issue with allowing duplicates of the same chart entry in the repository index file. By sending a specially-crafted input, an attacker could exploit this vulnerability to inject a bad chart into a repository.
41426	CVE-2020-15184	Helm could allow a remote attacker to bypass security restrictions, caused by improper input valuation by the alias field on a Chart.yaml. By sending a specially-crafted input, an attacker could exploit this vulnerability to inject unwanted information into a chart.
41614	CVE-2020-8252	Node.js is vulnerable to a buffer overflow, caused by improper bounds checking by the libuv's fs.realpath.native.
40043	CVE-2020-15586	Go is vulnerable to a denial of service, caused by a data race in some net/http servers. By sending specially-crafted HTTP requests, a remote attacker could exploit this vulnerability to cause a denial of service condition.

| 40043 | CVE-2020-14039 | Go could allow a remote attacker to bypass security restrictions, caused by improper validation on the VerifyOptions.KeyUsages EKU requirements during the X.509 certificate verification. An attacker could exploit this vulnerability to gain access to the system. | | 40347
42039| CVE-2020-16845 | Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. | | 41424
42039 | CVE-2020-4590 | IBM WebSphere Application Server Liberty running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of service attack conducted by an authenticated client. | | 43169 | CVE-2020-25659 | python-cryptography could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timing attack. | | 39032 | CVE-2020-8169 | cURL libcurl could allow a remote attacker to obtain sensitive information, caused by the failure to correctly URL encode the credential data when set using an curl_easy_setopt option. The host name and partial password is leaked in cleartext over DNS on HTTP redirect. An attacker could exploit this vulnerability to obtain sensitive information. | | 39032 | CVE-2020-8177 | cURL could allow a remote attacker to overwrite arbitrary files on the system, caused by the improper handling of certain parameters when using -J (--remote-header-name) and -I (--include) in the same command line. An attacker could exploit this vulnerability to overwrite a local file. | | 42920 | CVE-2020-14792 | An unspecified vulnerability in related to the component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and no availability impact. | | 42920 | CVE-2020-14797 | An unspecified vulnerability in Java SE, Java SE Embedded related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. | | 42920 | CVE-2020-14781 | An unspecified vulnerability in Java SE, Java SE Embedded related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. | | 42920 | CVE-2020-14779 | An unspecified vulnerability in Java SE, Java SE Embedded related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. | | 42920 | CVE-2020-14798 | An unspecified vulnerability in Java SE, Java SE Embedded related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. | | 42920 | CVE-2020-14796 | An unspecified vulnerability in Java SE, Java SE Embedded related to the Libraries component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. | | 42921 | CVE-2020-14782 | An unspecified vulnerability in Java SE, Java SE Embedded related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. |

The 3.2.1.2012 fix pack is cumulative and includes all fixes that were included in previous 3.2.1.x fix packs for IBM Cloud Private 3.2.1.

Updated images in 3.2.1.2012

Updated charts in 3.2.1.2012

Reported problems that are fixed in the IBM Cloud Private 3.2.1.2008 fix pack

The fixes included within this 3.2.1.2008 fix pack includes all fixes that are included within the 3.2.2.2008 fix pack that do not apply to the updated version of Kubernetes of the 3.2.2.2008 fix pack. The 3.2.1.2008 fix pack is intended for applying fixes to environments that use the 1.13.12 version of Kubernetes. If you apply the 3.2.2.2008 fix pack to upgrade the supported Kuberenetes version, do not apply the 3.2.1.2008 fix pack. If you need to upgrade the supported Kubernetes version, you must apply the 3.2.2.2008 fix pack instead of this 3.2.1.2008 fix pack.

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.1.2008

Fixed security-related vulnerabilities in 3.2.1.2008

Table: Fixed security vulnerabilities in fix pack 3.2.1.2008

Issue	CVE-ID	Description
31863	CVE-2019-1547	OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC group missing the cofactor using explicit parameters instead of using a named curve. An attacker could exploit this vulnerability to obtain full key recovery during an ECDSA signature operation.
31863	CVE-2019-1549	OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to include protection in the event of a fork() system call to ensure that the parent and child processes do not share the same RNG state. An attacker could exploit this vulnerability to obtain sensitive information.
35166 35312	CVE-2019-1551	OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By re-using the DH512 private key, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
31863	CVE-2019-1563	OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7_dataDecode and CMS_decrypt_set1_pkey. By sending an overly large number of messages to be decrypted, an attacker could exploit this vulnerability to obtain sensitive information.
35476	CVE-2020-7238	Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
34244	CVE-2019-7620	Elastic Logstash is vulnerable to a denial of service, caused by a flaw in the Beats input plugin. By sending a specially-crafted network packet, a remote attacker could exploit this vulnerability to cause the application to stop responding. Upgrade to the latest version of Logstash (6.8.4, 7.4.1 or later), available from the Elastic Web site.
37619	CVE-2019-11612	The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
35851	CVE-2019-15604	Node.js is vulnerable to a denial of service, caused by improper certificate validation. By sending a specially-crafted X.509 certificate, a remote attacker could exploit this vulnerability to cause the process to abort.
35851	CVE-2019-15605	Node.js vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
35851	CVE-2019-15606	Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have trailing OWS trimmed. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authorization based on header value comparisons.
38548	CVE-2020-7012	Elastic Kibana could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the Upgrade Assistant. By sending a specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code in the context of Kibana process on the host system.
38548	CVE-2020-7013	Elastic Kibana could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in TSVB . By sending a specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code in the context of Kibana process on the host system.
38548	CVE-2020-7015	Elastic Kibana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input in TSVB visualization. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
39076	CVE-2020-7614	Elastic Elasticsearch could allow a remote authenticated attacker to obtain sensitive information, caused by a race condition in the response headers. By sending specially-crafted requests, an attacker could exploit this vulnerability to obtain sensitive information of another user from the response header.
37996	CVE-2020-7921	MongoDB Server could allow a remote authenticated attacker to bypass security restrictions, caused by improper serialization of internal state in the authorization subsystem. An attacker could exploit this vulnerability to bypass IP whitelisting protection.
38874	CVE-2020-8203	Fixed for the Metering component only. Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the server and possibly execute arbitrary code on the system.
40048	CVE-2020-8553	Kubernetes ingress-nginx could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when the annotation nginx.ingress.kubernetes.io/auth-type: basic is used. By sending a specially crafted request, an attacker could exploit this vulnerability to create a new Ingress definition and replace the password file.
38544	CVE-2020-13401	Docker Docker CE is vulnerable to a man-in-the-middle attack, caused by improper validation of router advertisements. By sending rogue router advertisements, an attacker could exploit this vulnerability using man-in-the-middle techniques to gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
39229	CVE-2020-13597	Clusters using Calico (version 3.14.0 and earlier), Calico Enterprise (version 2.8.2 and earlier), can be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege can reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default. This vulnerability allows an attacker to redirect full or partial network traffic from the node to the compromised pod.
39222	CVE-2020-14422	Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.

The 3.2.1.2008 fix pack is cumulative and includes all fixes that were included in previous 3.2.1.x fix packs for IBM Cloud Private 3.2.1.

Updated images in 3.2.1.2008

Updated charts in 3.2.1.2008

Reported problems that are fixed in the IBM Cloud Private 3.2.1.2006 fix pack

The fixes included within this 3.2.1.2006 fix pack includes all fixes that are included within the 3.2.2.2006 fix pack that do not apply to the updated version of Kubernetes. The 3.2.1.2006 fix pack is intended for applying fixes to environments that use the 1.13.12 version of Kubernetes. If you apply the 3.2.2.2006 fix pack to upgrade the supported Kuberenetes version, do not apply the 3.2.1.2006 fix pack. If you need to upgrade the supported Kubernetes version, you must apply the 3.2.2.2006 fix pack instead of this 3.2.1.2006 fix pack.

Review the following tables, which identify the list of fixes and changes that are included in this fix pack to see see whether your reported problem was fixed:

Fixed problems in 3.2.1.2006

Fixed security-related vulnerabilities in 3.2.1.2006

Table: Fixed security vulnerabilities in fix pack 3.2.1.2006

Issue	CVE-ID	Description
38572 38573	CVE-2018-1002102	Kubernetes API server could allow a remote authenticated attacker to conduct phishing attacks, caused by an improper validation of URL redirection. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a victim to arbitrary Web sites.
34823 34859	CVE-2019-1551	OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By re-using the DH512 private key, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
31863 32149	CVE-2019-1547	OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC group missing the co-factor using explicit parameters instead of using a named curve. An attacker could exploit this vulnerability to obtain full key recovery during an ECDSA signature operation.
31863 32149	CVE-2019-1549	OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to include protection in the event of a fork() system call to ensure that the parent and child processes do not share the same RNG state. An attacker could exploit this vulnerability to obtain sensitive information.
31863 32149	CVE-2019-1563	OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7_dataDecode and CMS_decrypt_set1_pkey. By sending an overly large number of messages to be decrypted, an attacker could exploit this vulnerability to obtain sensitive information.
31866 32151	CVE-2019-5481	cURL libcurl is vulnerable to a denial of service, caused by a double free flaw during kerberos FTP data transfer. By sending a specially-crafted size of data, a remote attacker could exploit this vulnerability to cause a denial of service condition.
31866	CVE-2019-5482	cURL libcurl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the tftp_receive_packet function. By sending specially-crafted request containing an OACK without the BLKSIZE option, a remote attacker could overflow a buffer and execute arbitrary code on the system.
32678 23646	CVE-2019-9947	Python is vulnerable to HTTP header injection, caused by improper validation of input in urllib and urllib2. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
32678 23646	CVE-2019-9948	Python could allow a remote attacker to bypass security restrictions, caused by improper input validation by the urllib. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass the blacklist file: URIs protection mechanisms.
35851 35928 35952 35953 36565 36566	CVE-2019-15604	Node.js is vulnerable to a denial of service, caused by improper certificate validation. By sending a specially-crafted X.509 certificate, a remote attacker could exploit this vulnerability to cause the process to abort.
35851 35928 35952 35953 36565 36566	CVE-2019-15605	Node.js vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
35851 35928 35952 35953 36565 36566	CVE-2019-15606	Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have trailing OWS trimmed. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authorization based on header value comparisons.
32777 32933	CVE-2019-16935	Python is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the python/Lib/DocXMLRPCServer.py. A remote attacker could exploit this vulnerability using the server_title field to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
36569 36587	CVE-2019-17573	Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
37835 37846	CVE-2020-2754	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2755	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2756	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2757	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2781	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
37835 37846	CVE-2020-2800	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
37835 37846	CVE-2020-2803	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).
37835 37846	CVE-2020-2805	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).
37835 37846	CVE-2020-2830	Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
36802 36817	CVE-2020-4303	IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
36802 36817	CVE-2020-4304	IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
37620 37648	CVE-2020-4329	IBM WebSphere Application Server could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to conduct spoofing attacks.
37833 37844	CVE-2020-4421	IBM WebSphere Application Liberty could allow an authenticated user using openidconnect to spoof another users identify.
38545 38647 38649 38650	CVE-2020-8172	Node.js could allow a remote attacker to bypass security restrictions. The 'session' event could be emitted before the 'secureConnect' event and possibly allow for the reuse of the TLS session. An attacker could exploit this vulnerability to bypass host certificate verification and gain access to the system.
38545 38647 38649 38650	CVE-2020-8174	Node.js is vulnerable to a buffer overflow, caused by multiple memory corruptions in the napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16() functions. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
38545 38647 38649 38650	CVE-2020-10531	International Components for Unicode (ICU) for C/C++ is vulnerable to a heap-based buffer overflow, caused by an integer overflow in UnicodeString::doAppend() function in common/unistr.cpp. By sending a specially-crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
38545 38647 38649 38650	CVE-2020-11080	Node.js is vulnerable to a denial of service, caused by an error in the HTTP/2 session frame which is limited to 32 settings by default. By sending overly large HTTP/2 SETTINGS frames, an attacker could exploit this vulnerability to consume all available CPU resources.

Updated images in 3.2.1.2006

Updated charts in 3.2.1.2006

Reported problems that are fixed in the IBM Cloud Private 3.2.1.2003 fix pack

Review the list of fixed problems to see whether your reported problem was fixed in this fix pack:

Fixed problems in 3.2.1.2003

Fixed security-related vulnerabilities in 3.2.1.2003

Table: Fixed security vulnerabilities in fix pack 3.2.1.2003

Issue	CVE-ID	Description
36345	CVE-2019-4732	IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
34260	CVE-2019-16276	Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
35836 36345	CVE-2020-2583	An unspecified vulnerability in Java SE related to the Java SE Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
35836 36345	CVE-2020-2593	An unspecified vulnerability in Java SE related to the Java SE Networking component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and no availability impact.
35836 36345	CVE-2020-2604	An unspecified vulnerability in Java SE related to the Java SE Serialization component could allow an unauthenticated attacker to take control of the system.
35836 36345	CVE-2020-2659	An unspecified vulnerability in Java SE related to the Java SE Networking component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.

Reported problems that are fixed in the IBM Cloud Private 3.2.1.2001 fix pack

Review the list of fixed problems to see whether your reported problem was fixed in this fix pack.

Fixed problems in 3.2.1.2001

Fixed security-related vulnerabilities in 3.2.1.2001

Reported problems that are fixed in the IBM Cloud Private 3.2.1.1911 fix pack

Review the list of fixed problems to see whether your reported problem was fixed in this fix pack.

Fixed problems in 3.2.1.1911

Fixed security-related vulnerabilities in 3.2.1.1911

Table: Fixed security vulnerabilities in fix pack 3.2.1.1911

Issue	CVE-ID	Description
32147 32379	CVE-2019-16843	Fixed for the NGINX ingress component only. nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.
32147 32379	CVE-2019-16844	Fixed for the NGINX ingress component only. nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.
31863 32147 32379	CVE-2019-1547	Fixed for the NGINX ingress component only. Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
31863 32147 32379	CVE-2019-1549	Fixed for the NGINX ingress component only. OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
31863 32147 32379	CVE-2019-1563	Fixed for the NGINX ingress component only. In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
32602 32940	CVE-2019-4304	IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID: 160950.
32607 32940	CVE-2019-4305	IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951.
32608 32940	CVE-2019-4441	IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177.
32379	CVE-2019-9511	Fixed for the NGINX ingress component only. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
32979 33389	CVE-2019-9512	Fixed for the icp-platform-auth image only. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
32379 32979 33389	CVE-2019-9513	Fixed for the NGINX ingress component and icp-platform-auth image only. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
32979 33389	CVE-2019-9514	Fixed for the icp-platform-auth image only. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
32979 33389	CVE-2019-9515	Fixed for the icp-platform-auth image only. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
32379	CVE-2019-9516	Fixed for the NGINX ingress component only. Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
32979 33389	CVE-2019-9517	Fixed for the icp-platform-auth image only. Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
32979 33389	CVE-2019-9518	Fixed for the icp-platform-auth image only. Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
32589 32707 32708 32711 33422 33424 33736	CVE-2019-10744	Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
32771 32839 33080 33082 33331	CVE-2019-11251	Kubernetes could allow a remote attacker to gain unauthorized access to the system, caused by an error in kubectl cp that allows a combination of two symlinks to copy a file outside of its destination directory. An attacker could exploit this vulnerability to write arbitrary files outside of the destination tree.
32710 32838 32950 32952 32953 32956	CVE-2019-16276	Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
32975 33388	CVE-2019-17495	A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that

Reported problems that are fixed in the IBM Cloud Private 3.2.1.1910 fix pack

Review the list of fixed problems to see whether your reported problem was fixed in this fix pack.

Fixed problems in 3.2.1.1910

Fixed security-related vulnerabilities in 3.2.1.1910

Table: Fixed security vulnerabilities in fix pack 3.2.1.1910

Issue	CVE-ID	Description
32147	CVE-2019-1547	Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases, it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used, then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
32147	CVE-2019-1549	OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
32147	CVE-2019-1563	In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
19587 31145	CVE-2019-9512	Fixed for Heketi only. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
19587 31145	CVE-2019-9514	Fixed for Heketi only. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
32681	CVE-2019-9947	Fixed for the icp-storage-util image only. An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
32681	CVE-2019-9948	Fixed for the icp-storage-util image only. urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
31724	CVE-2019-11250	The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
19587 31145	CVE-2018-14647	Fixed for the icp-storage-util image only. Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. Python 3.8, 3.7, 3.6, 3.5, 3.4, 2.7 are believed to be vulnerable.
19587 31145	CVE-2019-14809	Fixed for Heketi only. net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
32837	CVE-2019-16276	Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

Reported problems that are fixed in IBM Cloud Private 3.2.1

Review the list of fixed problems to see whether your reported problem was fixed in this release.