IBM1CE53BC422F29ADFB61B4C256C90B3674F9862036E916326D286BD780B688FF6Security Bulletin: Vulnerability in IBM Java SDK and IBM Java Runtime affects Rational Business Developer
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
48.5%
Summary
There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 used by Rational Business Developer. Rational Business Developer has provided a fix for the applicable CVE. This issue was disclosed as part of the IBM Java SDK and Runtime Environment update deferred from IBM Java - OpenJ9 CVE-2022-3676
Vulnerability Details
CVEID:CVE-2022-3676
**DESCRIPTION:**Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a specially-crafted request using bytecode, an attacker could exploit this vulnerability to access or modify memory.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239608 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| RBD | 9.5 - 9.5.1.2 |
| RBD | 9.6 - 9.6.0.1 |
| RBD | 9.7 |
Remediation/Fixes
| Product | VRMF | APAR | Remediation / First Fix | File Name |
|---|---|---|---|---|
| Rational Business Developer | 9.5 - 9.5.1.2 | None | ||
| https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ERational&product=ibm/Rational/Rational+Business+Developer&release=9.5.0&platform=All&function=all | RBD_9.5_IBM_JDK8_SR7_FP20 | |||
| Rational Business Developer | 9.6 - 9.6.0.1 | None | https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ERational&product=ibm/Rational/Rational+Business+Developer&release=9.6&platform=All&function=all | RBD_9.6_IBM_JDK8_SR7_FP20 |
| Rational Business Developer | 9.7 | None | https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ERational&product=ibm/Rational/Rational+Business+Developer&release=9.7.0&platform=All&function=all | |
| RBD_9.7_IBM_JDK8_SR7_FP20 |
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| rational business developer | eq | 9.5 | |
| rational business developer | eq | 9.6 | |
| rational business developer | eq | 9.7 |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
48.5%