Security Bulletin: A vulnerability (CVE-2022-21299) in IBM Java Runtime affects CICS Transaction Gateway

Summary

IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 is used by CICS Transaction Gateway. The fix removes vulnerability CVE-2022-21299 that could allow an unauthenticated attacker to cause a denial of service.

Vulnerability Details

CVEID:CVE-2022-21299
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JAXP component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217594 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends you apply these fixes

Product

| VRMF|APAR|Remediation / First Fix
—|—|—|—
CICS Transaction Gateway for Multiplatforms| 9.2.0.0
9.2.0.1
9.2.0.2|

Updated JRE’s have been made available on Fix Central as Fix packs.
AIX: 8.0.7-CICSTG-AIXpSeries32-JRE-SR10
xLinux: 8.0.7-CICSTG-Linuxx8632-JRE-SR10
pLinux: 8.0.7-CICSTG-LinuxpSeries32-JRE-SR10
zLinux: 8.0.7-CICSTG-LinuxzSeries31-JRE-SR10
Windows:8.0.7-CICSTG-Windowsx8632-JRE-SR10

| Fix Central Link
CICS Transaction Gateway for Multiplatforms| 9.1.0.0
9.1.0.1
9.1.0.2
9.1.0.3|

Updated JRE’s have been made available on Fix Central as Fix packs.
AIX: 7.1.5-CICSTG-AIXpSeries32-JRE-SR10
xLinux: 7.1.5-CICSTG-Linuxx8632-JRE-SR10
pLinux: 7.1.5-CICSTG-LinuxpSeries32-JRE-SR10
zLinux: 7.1.5-CICSTG-LinuxzSeries31-JRE-SR10
Windows: 7.1.5-CICSTG-Windowsx8632-JRE-SR10

| Fix Central Link
CICS Transaction Gateway for Multiplatforms|

9.0.0.0
9.0.0.1
9.0.0.2
9.0.0.3
9.0.0.4

9.0.0.5
8.1.0.0
8.1.0.1
8.1.0.2
8.1.0.3
8.1.0.4
8.1.0.5
8.0.0.0
8.0.0.1
8.0.0.2
8.0.0.3
8.0.0.4
8.0.0.5
8.0.0.6

| Updated JRE’s have been made available on Fix Central as Fix packs.
Solaris: 7.0.11-CICSTG-SolarisSPARC32-JRE-SR10
AIX: 7.0.11-CICSTG-AIXpSeries32-JRE-SR10
xLinux: 7.0.11-CICSTG-Linuxx8632-JRE-SR10
pLinux: 7.0.11-CICSTG-LinuxpSeries32-JRE-SR10
zLinux: 7.0.11-CICSTG-LinuxzSeries31-JRE-SR10
Windows: 7.0.11-CICSTG-Windowsx8632-JRE-SR10| Fix Central Link

Workarounds and Mitigations

None