IBM350BE099FE4F017BEA9A4EC2A077996E4B3473A14B0E49A1EEEB72D56826E652Security Bulletin: A Vulnerability in IBM® Java™ SDK and IBM® Java™ Runtime that affect IBM® Intelligent Operations Center products (CVE-2019-2949)
EPSS
Percentile
49.1%
Summary
There is a vulnerability in IBM® SDK, Java™ Technology Edition versions 7 and 8, and IBM® Java™ Runtime versions 7 and 8 that are used by IBM® Intelligent Operations Center, IBM® Intelligent Operations Center for Emergency Management, IBM® Intelligent Water, and IBM® Water Operations for Waternamics. IBM® Intelligent Operations Center has addressed the applicable CVEs.
Vulnerability Details
CVEID:CVE-2019-2949
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Kerberos component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base score: 6.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/169254 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Intelligent Operations Center (IOC) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6, 5.2, 5.2.1 |
| IBM Water Operations for Waternamics (Linux) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6, 5.2, 5.2.1 |
| IBM Intelligent Operations Center for Emergency Management (Linux) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6 |
Remediation/Fixes
The recommended solution is to apply an interim fix that contains the fix for this issue as soon as practical.
Download the IBM Intelligent Operations Center Version 5.2.1.1 is an upgrade to IBM Intelligent Operations Center Version 5.1 through IBM Intelligent Operations Center Version 5.2 from the following link: IBM Intelligent Operations Center Version 5.2.1.1. Installation instructions for the fix are included in the readme document that is in the fix package.
Workarounds and Mitigations
None
Related
EPSS
Percentile
49.1%