-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


   #####################################################
  ##  N C S C ~ B E V E I L I G I N G S A D V I E S  ##
 #####################################################

Titel           : Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componenten
Advisory ID     : NCSC-2026-0431
Versie          : 1.00
Kans            : medium
CVE ID          : CVE-2023-53781, CVE-2025-5278, CVE-2025-14087,
                  CVE-2025-14512, CVE-2025-21858, CVE-2025-22105,
                  CVE-2025-37980, CVE-2025-38015, CVE-2025-38097,
                  CVE-2025-38180, CVE-2025-38400, CVE-2025-38405,
                  CVE-2025-38441, CVE-2025-38470, CVE-2025-38653,
                  CVE-2025-39766, CVE-2025-39797, CVE-2025-39866,
                  CVE-2025-40134, CVE-2025-48431, CVE-2025-68183,
                  CVE-2025-68211, CVE-2025-68214, CVE-2025-68347,
                  CVE-2025-68366, CVE-2025-68724, CVE-2025-71066,
                  CVE-2025-71089, CVE-2026-2100, CVE-2026-2391,
                  CVE-2026-3832, CVE-2026-3833, CVE-2026-4046,
                  CVE-2026-4437, CVE-2026-4438, CVE-2026-5260,
                  CVE-2026-5419, CVE-2026-5450, CVE-2026-12143,
                  CVE-2026-13257, CVE-2026-13258, CVE-2026-13757,
                  CVE-2026-14269, CVE-2026-14273, CVE-2026-14496,
                  CVE-2026-14497, CVE-2026-14502, CVE-2026-14507,
                  CVE-2026-14508, CVE-2026-14509, CVE-2026-14888,
                  CVE-2026-14905, CVE-2026-14988, CVE-2026-14990,
                  CVE-2026-14991, CVE-2026-14992, CVE-2026-14999,
                  CVE-2026-15588, CVE-2026-15762, CVE-2026-15781,
                  CVE-2026-15784, CVE-2026-15819, CVE-2026-15822,
                  CVE-2026-15824, CVE-2026-16111, CVE-2026-16159,
                  CVE-2026-16161, CVE-2026-16163, CVE-2026-16164,
                  CVE-2026-16165, CVE-2026-16167, CVE-2026-16169,
                  CVE-2026-16170, CVE-2026-16176, CVE-2026-16177,
                  CVE-2026-16178, CVE-2026-16179, CVE-2026-16181,
                  CVE-2026-16182, CVE-2026-16340, CVE-2026-16439,
                  CVE-2026-16440, CVE-2026-16441, CVE-2026-22979,
                  CVE-2026-22984, CVE-2026-22990, CVE-2026-23002,
                  CVE-2026-23060, CVE-2026-23110, CVE-2026-23204,
                  CVE-2026-23209, CVE-2026-23216, CVE-2026-23243,
                  CVE-2026-23270, CVE-2026-23392, CVE-2026-23455,
                  CVE-2026-31411, CVE-2026-31419, CVE-2026-31488,
                  CVE-2026-31508, CVE-2026-31532, CVE-2026-31581,
                  CVE-2026-31607, CVE-2026-31613, CVE-2026-31669,
                  CVE-2026-31677, CVE-2026-31684, CVE-2026-31685,
                  CVE-2026-33845, CVE-2026-33846, CVE-2026-41254,
                  CVE-2026-41602, CVE-2026-41606, CVE-2026-41607,
                  CVE-2026-42009, CVE-2026-42010, CVE-2026-42011,
                  CVE-2026-42012, CVE-2026-42013, CVE-2026-42014,
                  CVE-2026-42015, CVE-2026-43027, CVE-2026-43037,
                  CVE-2026-43038, CVE-2026-43056, CVE-2026-43074,
                  CVE-2026-43116, CVE-2026-43125, CVE-2026-43163,
                  CVE-2026-43190, CVE-2026-43198, CVE-2026-43260,
                  CVE-2026-43284, CVE-2026-43303, CVE-2026-43329,
                  CVE-2026-43499, CVE-2026-43501, CVE-2026-43868,
                  CVE-2026-43870, CVE-2026-45852, CVE-2026-46054,
                  CVE-2026-46086, CVE-2026-46116, CVE-2026-46173,
                  CVE-2026-46181, CVE-2026-46242, CVE-2026-46259,
                  CVE-2026-46300, CVE-2026-46331, CVE-2026-46333,
                  CVE-2026-46917, CVE-2026-46968, CVE-2026-47010,
                  CVE-2026-47021, CVE-2026-47027, CVE-2026-47059,
                  CVE-2026-47063, CVE-2026-48144, CVE-2026-48145,
                  CVE-2026-52923, CVE-2026-52991, CVE-2026-53006,
                  CVE-2026-53009, CVE-2026-53131, CVE-2026-53189,
                  CVE-2026-53264, CVE-2026-53266, CVE-2026-55602,
                  CVE-2026-55603, CVE-2026-55968, CVE-2026-55970,
                  CVE-2026-58010, CVE-2026-58011, CVE-2026-58012,
                  CVE-2026-58013, CVE-2026-58014, CVE-2026-58015,
                  CVE-2026-58016, CVE-2026-58662, CVE-2026-59879,
                  CVE-2026-59880, CVE-2026-60147, CVE-2026-60589,
                  CVE-2026-61308, CVE-2026-63913, CVE-2026-63952,
                  CVE-2026-64017, CVE-2026-64530, CVE-2026-64560,
                  CVE-2026-70906, CVE-2026-70907, CVE-2026-74581,
                  CVE-2026-82417, CVE-2026-82562, CVE-2026-83605,
                  CVE-2026-83607, CVE-2026-83608, CVE-2026-83613,
                  CVE-2026-83614, CVE-2026-83615, CVE-2026-83616,
                  CVE-2026-83619
                  (Details over de kwetsbaarheden kunt u vinden op
                   de Mitre website: https://cve.mitre.org/cve/)
Schade          : high
                  Improper Limitation of a Pathname to a Restricted
                  Directory ('Path Traversal')
                  Improper Neutralization of Input During Web Page
                  Generation ('Cross-site Scripting')
                  Improper Neutralization of Argument Delimiters in a
                  Command ('Argument Injection')
                  XML Injection (aka Blind XPath Injection)
                  Improper Neutralization of CRLF Sequences ('CRLF
                  Injection')
                  Improper Neutralization of CRLF Sequences in HTTP
                  Headers ('HTTP Request/Response Splitting')
                  Buffer Copy without Checking Size of Input ('Classic
                  Buffer Overflow')
                  Stack-based Buffer Overflow
                  Heap-based Buffer Overflow
                  Write-what-where Condition
                  Buffer Underwrite ('Buffer Underflow')
                  Out-of-bounds Read
                  Buffer Over-read
                  Improper Handling of Length Parameter Inconsistency
                  Incorrect Calculation of Buffer Size
                  Improper Null Termination
                  Encoding Error
                  Improper Handling of Case Sensitivity
                  Incorrect Behavior Order: Early Validation
                  Partial String Comparison
                  Integer Overflow or Wraparound
                  Integer Underflow (Wrap or Wraparound)
                  Off-by-one Error
                  Observable Timing Discrepancy
                  Uncaught Exception
                  Use of Hard-coded Password
                  Incorrect Privilege Assignment
                  Improper Handling of Insufficient Permissions or
                  Privileges
                  Improper Certificate Validation
                  Improper Validation of Certificate with Host Mismatch
                  Origin Validation Error
                  Improper Verification of Cryptographic Signature
                  Improper Validation of Integrity Check Value
                  Improperly Implemented Security Check for Standard
                  Concurrent Execution using Shared Resource with
                  Improper Synchronization ('Race Condition')
                  Signal Handler Race Condition
                  Race Condition within a Thread
                  Time-of-check Time-of-use (TOCTOU) Race Condition
                  Detection of Error Condition Without Action
                  Missing Release of Memory after Effective Lifetime
                  Improper Resource Shutdown or Release
                  Asymmetric Resource Consumption (Amplification)
                  Inefficient Algorithmic Complexity
                  Improper Resource Locking
                  Double Free
                  Use After Free
                  Missing Handler
                  Incomplete Cleanup
                  Undefined Behavior for Input to API
                  NULL Pointer Dereference
                  Deserialization of Untrusted Data
                  Unchecked Input for Loop Condition
                  Improper Restriction of XML External Entity Reference
                  Reachable Assertion
                  Null Byte Interaction Error (Poison Null Byte)
                  Uncontrolled Recursion
                  Incorrect Behavior Order
                  Reliance on Undefined, Unspecified, or Implementation-
                  Defined Behavior
                  Mismatched Memory Management Routines
                  Release of Invalid Pointer or Reference
                  Allocation of Resources Without Limits or Throttling
                  Missing Release of Resource after Effective Lifetime
                  Out-of-bounds Write
                  Memory Allocation with Excessive Size Value
                  Buffer Access with Incorrect Length Value
                  Missing Synchronization
                  Incorrect Synchronization
                  Untrusted Pointer Dereference
                  Access of Uninitialized Pointer
                  Expired Pointer Dereference
                  Deadlock
                  Loop with Unreachable Exit Condition ('Infinite Loop')
                  Inappropriate Encoding for Output Context
                  Access of Resource Using Incompatible Type ('Type
                  Confusion')
                  Incorrect Authorization
                  Use of Uninitialized Resource
                  Missing Initialization of Resource
                  Improper Update of Reference Count
                  Improper Validation of Specified Quantity in Input
                  Improper Validation of Specified Index, Position, or
                  Offset in Input
                  Improper Validation of Syntactic Correctness of Input
                  Improper Validation of Specified Type of Input
                  Improper Validation of Consistency within Input
                  Inefficient Regular Expression Complexity
                  Multiple Releases of Same Resource or Handle
Uitgiftedatum   : 20261016
Toepassing      : IBM DataPower Gateway
                  IBM DataPower Gateway 10.5.0
                  IBM DataPower Gateway 10.6.0
                  IBM DataPower Gateway 10.6CD
                  IBM DataPower Gateway 11.0.0
Versie(s)       :
Platform(s)     :

Beschrijving
   IBM heeft meerdere beveiligingsproblemen opgelost in DataPower
   Gateway versies 10.5 tot 11.0 en een veelvoud aan onderliggende
   subcomponenten.

   De kwetsbaarheden betreffen een breed scala aan problemen zoals use-
   after-free bugs, race conditions, buffer overflows, null pointer
   dereferences, integer overflows, geheugenlekken, onjuiste validatie,
   en cryptografische fouten.
   Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit
   te voeren die remote code execution, denial of service, cross-site
   scripting, en bypass van autorisatie mogelijk maken, waarbij sommige
   aanvallen authenticatie vereisen en andere niet.
   Naast de kwetsbaarheden in DataPower Gateway heeft IBM ook een
   veelvoud aan kwetsbaarheden verholpen in onderliggende
   subcomponenten. Voor deze onderliggende subcomponenten zijn eerder
   updates verschenen voor de individuele systemen. IBM heeft deze
   updates nu verwerkt in de eigen software stack van DataPower Gateway.

Mogelijke oplossingen
   IBM heeft patches beschikbaar gesteld voor de DataPower Gateway-
   productlijn. Zie bijgevoegde referenties voor meer informatie.

   Referenties:
      Reference
      https://www.ibm.com/support/pages/node/7289776

      Reference
      https://www.ibm.com/support/pages/node/7289778

      Reference
      https://www.ibm.com/support/pages/node/7289779

      Reference
      https://www.ibm.com/support/pages/node/7289780

      Reference
      https://www.ibm.com/support/pages/node/7289783

      Reference
      https://www.ibm.com/support/pages/node/7289785

      Reference
      https://www.ibm.com/support/pages/node/7289789

      Reference
      https://www.ibm.com/support/pages/node/7289790

      Reference
      https://www.ibm.com/support/pages/node/7289798

Vrijwaringsverklaring
   Door gebruik van deze security advisory gaat u akkoord met de
   navolgende voorwaarden. Ondanks dat het NCSC de grootst mogelijke
   zorg heeft betracht bij de samenstelling van dit beveiligingsadvies,
   kan het NCSC niet instaan voor de volledigheid, juistheid of
   (voortdurende) actualiteit van dit beveiligingsadvies. De informatie
   in dit beveiligingsadvies is uitsluitend bedoeld als algemene
   informatie voor professionele partijen. Aan de informatie in dit
   beveiligingsadvies kunnen geen rechten worden ontleend. Het NCSC
   en de Staat zijn niet aansprakelijk voor enige schade ten gevolge
   van het gebruik of de onmogelijkheid van het gebruik van dit
   beveiligingsadvies, waaronder begrepen schade ten gevolge van de
   onjuistheid of onvolledigheid van de informatie in dit
   beveiligingsadvies. Op dit beveiligingsadvies is Nederlands recht
   van toepassing. Alle geschillen in verband met en/of voortvloeiend
   uit dit beveiligingsadvies zullen worden voorgelegd aan de exclusief
   bevoegde rechter te Den Haag. Deze rechtskeuze geldt tevens voor de
   voorzieningenrechter in kort geding.
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEGSwziqblmmRNtImqgupWoL0ZhGEFAmrRwX8ACgkQgupWoL0Z
hGGzSQv7Bb+nJ1NKpajN9hxCjYaovo2BnWChX3KlqfpGDTj7XC6Exia1jAD43Qw7
AmTpOGIQ+fXl74Ia4sAoSTt1WG3wLRLHCBTq0XL+ef/XjTsPupEL+JxKg9bWDL8r
qkRwfhLoMXvOs+grRM+ywxH8Zy1gruZjFhmRYw//Vs1ZaZOqFA2vBVh0YGd6KBsS
rB4w49peTnlubIH5mc5fUTTdh3RVZpE8rRQI+DjHiwET+4107GwrFpvqKkZlwOk1
966EIWIHZJVh7pIZQEWCcWtj+QUa8QBxek5N/L3TQqjZQNIxf35IfDsIzl/aSTOC
gGF6MNkiFLzhjZTovkXMgKJJSiU95WS3U1YaoDJTXEwH6k0qhz8R59yvJsSy/HVk
3Zu6zrXS8IhQHQDskCMcqnAydFmQgez9OV91cSPNGwFAeCyrp8RDnVBGVR8t8/lS
DhdSW8ygEHxn3RY5m3843z7XEDBpI4Tc+SpaXlIw+8b/XuIkvsXz69yD1pEMsxEw
MMQHPp8y
=ta4B
-----END PGP SIGNATURE-----