Lucene search

IBM03315AC7DD7182C5EA09FE217ED7D55F3271F43B439857D99B6CBB2A7ED87D72

HistoryMay 31, 2024 - 2:39 p.m.

Security Bulletin: Maximo Asset Management: IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024 - Includes Oracle April 2024 CPU plus CVE-2023-38264

2024-05-3114:39:53

www.ibm.com

ibm maximo asset management

java sdk

ibm control desk

websphere application server

oracle

cve-2023-38264

security bulletin

update

browser client

admin tools

fix pack

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 that are used by Maximo Asset Management, Maximo Industry Solutions (including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities) and IBM Control Desk. These issues were disclosed as part of the IBM Java SDK updates in Apr 2024.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Maximo Asset Management	7.6.1.3

Remediation/Fixes

There are three areas where the vulnerabilities in the Java SDK/JDK or JRE may require remediation:

1. Application Server – Update the Websphere Application Server. Refer to Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to January 2024 CPU for additional information on updating and maintaining the JDK component within Websphere. Customers with Oracle Weblogic Server, which is not an IBM product and is not shipped by IBM, will also want to update their server.

2. Browser Client - Update the Java plug-in used by the browser on client systems, using the remediated JRE version referenced on developerWorks JavaTM Technology Security Alerts or referenced on Oracle’s latest Critical Patch Update (which can be accessed via developerWorks JavaTM Technology Security Alerts). Updating the browser Java plug-in may impact some applets such as Maximo Asset Management Scheduler. Download from IBM FixCentral the latest Maximo Asset Management Fix Pack.

3. Admin Tools - Update the JRE version in the <MAXIMO_HOME>/tools/java directory using the remediated JRE version referenced on Java SDK downloads, version 8.0.

Due to the threat posed by a successful attack, IBM strongly recommends that customers apply fixes as soon as possible.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmaximo_for_utilitiesMatch7.6.0.2

ibmmaximo_for_utilitiesMatch7.6.0.1

ibmmaximo_asset_configuration_managerMatch7.6.7.1

ibmmaximo_asset_configuration_managerMatch7.6.7

ibmmaximo_asset_configuration_managerMatch7.6.6

ibmmaximo_spatial_asset_managementMatch7.6.0.5

ibmmaximo_spatial_asset_managementMatch7.6.0.4

ibmmaximo_spatial_asset_managementMatch7.6.0.3

ibmmaximo_spatial_asset_managementMatch7.6.0.2

ibmmaximo_for_life_sciencesMatch7.6

ibmmaximo_for_transportationMatch7.6.2.5

ibmmaximo_for_transportationMatch7.6.2.4

ibmmaximo_for_transportationMatch7.6.2.3

ibmcontrol_deskMatch7.6.1.1

ibmcontrol_deskMatch7.6.1

ibmmaximo_for_aviationMatch7.6.8

ibmmaximo_for_aviationMatch7.6.7

ibmmaximo_for_aviationMatch7.6.6

ibmmaximo_for_service_providersMatch7.6.3.3

ibmmaximo_for_service_providersMatch7.6.3.2

ibmmaximo_for_service_providersMatch7.6.3.1

ibmmaximo_for_oil_and_gasMatch7.6.1

ibmmaximo_for_nuclear_powerMatch7.6.1

ibmmaximo_asset_managementMatch7.6.1

CPENameOperatorVersion
maximo for utilitieseq7.6.0.2
maximo for utilitieseq7.6.0.1
maximo asset configuration managereq7.6.7.1
maximo asset configuration managereq7.6.7
maximo asset configuration managereq7.6.6
maximo spatial asset managementeq7.6.0.5
maximo spatial asset managementeq7.6.0.4
maximo spatial asset managementeq7.6.0.3
maximo spatial asset managementeq7.6.0.2
maximo for life scienceseq7.6

Name	Operator	Version
maximo for utilities	eq	7.6.0.2
maximo for utilities	eq	7.6.0.1
maximo asset configuration manager	eq	7.6.7.1
maximo asset configuration manager	eq	7.6.7
maximo asset configuration manager	eq	7.6.6
maximo spatial asset management	eq	7.6.0.5
maximo spatial asset management	eq	7.6.0.4
maximo spatial asset management	eq	7.6.0.3
maximo spatial asset management	eq	7.6.0.2
maximo for life sciences	eq	7.6