IBM Guardium Data Protection 12.0 Security Bulletin: Multiple Vulnerabilities (CVE-2025-29808, CVE-2025-24970, CVE-2023-6766)

Key Information Vulnerability Overview Product: IBM Guardium Data Protection Version: 12.0 Update: Updates have been released to address multiple vulnerabilities Vulnerability Details CVE-2025-29808 - Description: A cache collision vulnerability in the Netty QUIC codec may lead to increased CPU load on the server. - CVSS Score: 5.3 CVE-2025-29029 - Description: IBM Security Guardium may allow remote attackers to obtain sensitive information via technical error messages displayed in the browser. - CVSS Score: 4.3 CVE-2025-24970 - Description: A vulnerability in the Netty asynchronous event-driven network application framework in specific versions may lead to local code execution or bypass security restrictions. - CVSS Score: 7.5 CVE-2025-25193 - Description: A vulnerability in the Netty asynchronous event-driven network application framework in specific versions may lead to denial of service. - CVSS Score: 5.5 CVE-2023-6766 - Description: The HttpURI class in Eclipse Jetty has validation issues when processing HTTP/HTTPS URIs, potentially leading to open redirect attacks or SSRF attacks. - CVSS Score: 3.7 CVE-2024-47535 - Description: Netty has a resource consumption issue when handling invalid hostnames. - CVSS Score: 5.5 CVE-2023-29029 - Description: IBM Security Guardium may allow privileged users to download any file on the system. - CVSS Score: 6.9 CVE-2023-35026 - Description: IBM Security Guardium may allow authenticated users to bypass data access checks and obtain sensitive information. - CVSS Score: 4.3 Affected Products and Versions IBM Guardium Data Protection: Version 12.0 Remediation Recommendation: Upgrade to the latest version to fix these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Guardium Data Protection 12.0 Security Bulletin: Multiple Vulnerabilities (CVE-2025-29808, CVE-2025-24970, CVE-2023-6766)