SB2026071543 - Multiple vulnerabilities in IBM Cloud Object Storage System
Published: July 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-39892)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read in Python buffer-accepting APIs when processing a non-contiguous buffer. A local user can pass a specially crafted non-contiguous buffer to cause a denial of service.
The issue can read past the end of the buffer on Python versions later than 3.11.
2) Incorrect calculation (CVE-ID: CVE-2025-14813)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause cryptographic operations to fail.
The vulnerability exists due to improper implementation in G3413CTRBlockCipher when encrypting or decrypting more than 255 blocks. A remote attacker can supply data that exceeds this limit to cause cryptographic operations to fail.
The issue affects the GOST-R-3413-2015 CTR mode implementation because it uses a single-byte counter instead of a counter size aligned with the algorithm definition.
3) Covert Timing Channel (CVE-ID: CVE-2026-5598)
CWE-ID: CWE-385 - Covert Timing Channel
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to a covert timing channel in FrodoEngine.java in the BC-JAVA core modules when performing cryptographic operations. A remote attacker can measure timing differences to disclose sensitive information.
Remediation
Install update from vendor's website.