IBM02F6B48E04CC7EC02C560CD9B0AE7D4D4E3D140BB749ED18AF030E2ACD68506DSecurity Bulletin: Due to use of Java 8.0.7.11 version, InfoSphere Data Replication is vulnerable to crypto attacks.
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
57.1%
Summary
InfoSphere Data Replication is using Java 8.0.7.11 as both, a build time environment and a runtime environment, which was exposed to the vulnerabilities reported in CVE-2023-30441.
Vulnerability Details
CVEID:CVE-2023-30441
**DESCRIPTION:**IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253188 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| InfoSphere Data Replication | All |
Remediation/Fixes
The Java version used by the product has been upgraded to 8.0.8.0. IBM strongly recommends addressing the vulnerability now by upgrading to the latest release of InfoSphere Data Replication software.
Workarounds and Mitigations
None
Affected configurations
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
57.1%