Security Bulletin: IBM Event Streams is affected by WebSphere Liberty Profile vulnerability CVE-2019-4720

Summary

IBM Event Streams has addressed the following vulnerability

Vulnerability Details

CVEID:CVE-2019-4720
**DESCRIPTION:**IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available memory. IBM X-Force ID: 172125.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172125 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

IBM Event Streams in IBM Cloud Pak for Integration

|

2019.2.2

IBM Event Streams in IBM Cloud Pak for Integration

|

2019.2.3

IBM Event Streams

|

2019.4.1

IBM Event Streams in IBM Cloud Pak for Integration

| 2019.4.1

Remediation/Fixes

Upgrade from IBM Event Streams 2019.2.1 to IBM Event Streams 2019.4.1 by downloading IBM Event Streams 2019.4.1 from IBM Passport Advantage.

Upgrade from IBM Event Streams 2019.4.1 to the latest Fix Pack.

Upgrade IBM Event Streams 2019.2.2, IBM Event Streams 2019.2.3 and IBM Event Streams 2019.4.1 in IBM Cloud Pak for Integration by downloading IBM Event Streams 2019.4.2 in IBM Cloud Pak for Integration 2020.2.1 from IBM Passport Advantage.

Workarounds and Mitigations

None