Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Velocity

Summary

A vulnerability has been identified in Apache Velocity, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions.

Vulnerability Details

CVEID:CVE-2020-13936
**DESCRIPTION:**Apache Velocity could allow a remote attacker to execute arbitrary code on the system, caused by a sandbox bypass flaw. By modifying the Velocity templates, an attacker could exploit this vulnerability to execute arbitrary code with the same privileges as the account running the Servlet container.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/197993 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

Adopted new Apache Velocity 1.7 version.

STEPS TO APPLY THE REMEDIATION:

Advising users who are on ELM 7.0, 7.0.1 or any other version below 7.0.2 to upgrade your products to Maintenance release 7.0.2 version as these products have reached end of life. Optionally, upgrade to the latest 7.0.3 version.

Workarounds and Mitigations

None