IBM147BF90F853EF0170D8C4ECBBC4703F10E9521CD033D937B4A5ECB9A47FEA3BDSecurity Bulletin: IBM Sterling B2B Integrator is vulnerable to denial of service due to Google Gson (CVE-2022-25647)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
64.4%
Summary
IBM Sterling B2B Integrator has addressed a denial of service vulnerability in Google Gson.
Vulnerability Details
CVEID:CVE-2022-25647
**DESCRIPTION:**Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the writeReplace() method, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217225 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Sterling B2B Integrator | 6.0.0.0 - 6.0.3.6 |
| IBM Sterling B2B Integrator | 6.1.0.0 - 6.1.0.5, 6…1.1.0 - 6.1.1.1, 6.1.2.0 |
Remediation/Fixes
| Product | Version | APAR | Remediation & Fix |
|---|---|---|---|
| IBM Sterling B2B Integrator | 6.0.0.0 - 6.0.3.6 | IT42828 | Apply 6.0.3.7 |
| IBM Sterling B2B Integrator | 6.1.0.0 - 6.1.0.5 | ||
| 6.1.1.0 - 6.1.1.1 | |||
| 6.1.2.0 |
IT42828
| Apply 6.1.0.6, 6.1.1.3 or 6.1.2.1
The version 6.0.3.7, 6.1.0.6, 6.1.1.3 and 6.1.2.1 are available on Fix Central.
The container version of 6.1.2.1 is available in IBM Entitled Registry with following tags.
- cp.icr.io/cp/ibm-b2bi/b2bi:6.1.2.1 for IBM Sterling B2B Integrator
- cp.icr.io/cp/ibm-sfg/sfg:6.1.2.1 for IBM Sterling File Gateway
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm sterling b2b integrator | eq | 6.0.0.0 | |
| ibm sterling b2b integrator | eq | 6.1.2.1 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
64.4%