Lucene search

K
ibmIBM24E4E96A5946B7A9D5D953A6781A672A77C96F0F14DB0D5014D7C16F38035CAD
HistoryJun 05, 2024 - 7:14 a.m.

Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Commons Collections

2024-06-0507:14:06
www.ibm.com
6
ibm engineering lifecycle management
apache commons collections
cve-2017-15708
cve-2015-4852
cve-2019-13116
remediation
upgrade
maintenance release

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

10

Confidence

High

EPSS

0.967

Percentile

99.7%

Summary

Multiple vulnerabilities have been identified in Apache Commons Collections, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions.

Vulnerability Details

CVEID:CVE-2017-15708
**DESCRIPTION:**Apache Synapse could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Apache Commons Collections. By injecting specially-crafted serialized objects, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/136262 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2015-4852
**DESCRIPTION:**Oracle WebLogic Server could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the WLS Security component due to the deserialization of data of unauthenticated Java objects in the Apache Commons Collections (ACC) library. By using a specially crafted serialiazed Java object in T3 protocol traffic to TCP port 7001, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/260094 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2019-13116
**DESCRIPTION:**MuleSoft Mule runtime could allow a remote attacker to execute arbitrary code on the system, caused by Java deserialization, related to Apache Commons Collections. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/169704 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
Jazz Foundation 7.0.2

Remediation/Fixes

Adopted new Apache commons-collections-3.2.2 version.

STEPS TO APPLY THE REMEDIATION:

Advising users who are on ELM 7.0, 7.0.1 or any other version below 7.0.2 to upgrade your products to Maintenance release 7.0.2 version as these products have reached end of life. Optionally, upgrade to the latest 7.0.3 version.

Affected Product(s) Version(s) Remediation/Fix/Instructions
Jazz Foundation 7.0.2 Download and install iFix029 or later

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmibm_engineering_lifecycle_management_baseMatch7.0.2

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

10

Confidence

High

EPSS

0.967

Percentile

99.7%