Security Bulletin: Vulnerability in Apache Commons might affect WebSphere Industry Content Packs and IBM Business Process Manager Industry Packs (CVE-2015-7450)

Summary

A vulnerability for handling Java object deserialization in the Apache Commons Collections open source library has been reported. A vulnerable version of the library is included in templates shipped with WebSphere Industry Content Packs and IBM Business Process Manager Industry Packs.

Vulnerability Details

CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of data with Java InvokerTransformer class. By sending specially crafted data, an attacker could exploit this vulnerability to execute arbitrary Java code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107918 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

• WebSphere Industry Content Packs 7.0.0.0 through 7.0.0.3
• IBM Business Process Manager Industry Packs 7.5.x

Remediation/Fixes

Artifacts contained in WebSphere Industry Content Packs and IBM Business Process Manager Industry Packs can be customized and deployed on server products running on top of IBM WebSphere Application Server V7. Please review Security Bulletin: Vulnerability in Apache Commons affects IBM WebSphere Application Server (CVE-2015-7450) and download and install the suggested fixes.

Workarounds and Mitigations

When building your own applications based on the templates provided in WebSphere Industry Content Packs and IBM Business Process Manager Industry Packs, make sure to include the latest version of Apache Commons Collections and remove all other versions. Specifically, replace commons-collections-3.2.1.jar with commons-collections-3.2.2.jar in all existing and new applications.

A patched version is available for download on Apache’s proceject web site: <https://commons.apache.org/proper/commons-collections/download_collections.cgi&gt;

IBM recommends that you review your entire environment to identify vulnerable releases of the open-source Apache Commons Collections and take appropriate mitigation and remediation actions.