Lucene search

IBM2D92580DE164D28D0958EBF2E4E78F5982A821D6CF8C8476D1BDC99E41D4642F

HistoryFeb 02, 2023 - 11:06 a.m.

Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to an unspecified vulnerability due to IBM Java Runtime (CVE-2021-35550)

2023-02-0211:06:46

www.ibm.com

ibm sterling connect:direct file agent

java runtime

vulnerability

cve-2021-35550

confidentiality

fix

it41040

ifix026

ifix036

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:C/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

65.1%

JSON

Summary

There is a vulnerability in IBM® Runtime Environment Java™ Version 7 and 8 used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable CVE.

Vulnerability Details

CVEID:CVE-2021-35550
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211627 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Sterling Connect:Direct File Agent

1.4.0.0 - 1.4.0.2_iFix025 with bundled JRE on AIX, Linux, Solaris and Windows

1.4.0.0 - 1.4.0.2_iFix035 with bundled JRE on HP-UX

Remediation/Fixes

Product(s)	Version(s)	APAR	Remediation / Fix
IBM Sterling Connect:Direct File Agent

1.4.0.0 - 1.4.0.2_iFix025 on AIX, Linux, Solaris and Windows

1.4.0.0 - 1.4.0.2_iFix035 on HP-UX

| IT41040|

Apply 1.4.0.2_iFix026 on AIX, Linux, Solaris and Windows, available on IBM Fix Central

Apply 1.4.0.2_iFix036 on HP-UX, available on IBM Fix Central

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsterling_connect\Matchdirect1.4

VendorProductVersionCPE
ibmsterling_connect\directcpe:2.3:a:ibm:sterling_connect\:direct:1.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	sterling_connect\	direct	cpe:2.3:a:ibm:sterling_connect\:direct:1.4:::::::*

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:C/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

65.1%

JSON

Related for 2D92580DE164D28D0958EBF2E4E78F5982A821D6CF8C8476D1BDC99E41D4642F