IBM34FBAEEF366CB7DE704637DD9387142E0E5FB15840BA5A401EF615225B7C1FE1Security Bulletin: IBM DataPower Gateway affected by vulnerability in Java (CVE-2022-21626)
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
52.2%
Summary
IBM has addressed the CVE, which potentially affects JDBC, IMS Callout and JMS components
Vulnerability Details
CVEID:CVE-2022-21626
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238689 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM DataPower Gateway V10CD | 10.0.4.0 - 10.0.4.0sr2 |
| IBM DataPower Gateway 10.0.1 | 10.0.1.0 - 10.0.1.10 |
| IBM DataPower Gateway 10.5.0 | 10.5.0.0 - 10.5.02 |
| IBM DataPower Gateway | 2018.4.1.0 - 2018.4.1.23 |
Remediation/Fixes
| Affected product | Fixed in version | APAR |
|---|---|---|
| IBM DataPower Gateway 2018.4.1 | 2018.4.1.24 | IT42249 |
| IBM DataPower Gateway 10.0.1 | 10.0.1.11 | IT42249 |
| IBM DataPower Gateway 10.5.0 | 10.5.0.3 | IT42249 |
A fix will be available in a future security refresh of V10CD. Customers wishing to obtain the fix immediately may upgrade free of charge to 10.5.0.3
Workarounds and Mitigations
None
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
52.2%