Security Bulletin: Vulnerability in IBM Java SDK affects IMS™ Enterprise Suite: Explorer for Development (CVE-2018-3180)

Summary

There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.5.20 and earlier that is used by IMS™ Enterprise Suite: Explorer for Development. This issue was disclosed as part of the IBM Java SDK updates in October 2018.

Vulnerability Details

CVE-2018-3180 (CVSS 5.6)

Description

A flaw in the JSSE component means that TLS connections do not always check the validity of the hostname on the server-side certificate.

The fix ensures that server-side certificates are checked correctly.

Affected Products and Versions

Explorer for Development of the IMS™ Enterprise Suite Versions 3.3.1 and earlier.

Remediation/Fixes

Product

|

VRMF

|

APAR

|

Download URL

—|—|—|—

IMS Enterprise Suite Explorer for Development V3.3

|

3.3.1.13

|

N/A

|

_https://developer.ibm.com/mainframe/products/downloads/eclipse-tools/_

IMS Enterprise Suite Explorer for Development V3.2

|

_ 3.2.1.17_

|

N/A

|

_https://developer.ibm.com/mainframe/products/downloads/eclipse-tools/_