Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to a denial of service due to jackson-databind (CVE-2020-36518)

Summary

IBM Integration Bus and IBM App Connect Enterprise are vulnerable to a denial of service due to jackson-databind, caused by a Java StackOverflow exception. The fix includes jackson-databind 2.13.3

Vulnerability Details

CVEID:CVE-2020-36518
**DESCRIPTION:**FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By using a large depth of nested objects, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222319 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by the applying the appropriate fix to IBM Integration Bus

Product(s)

|

Version(s)

|

APAR

|

Remediation / Fix

—|—|—|—

IBM Integration Bus (Windows & Linux only)

|

v10.0.0.0 - v10.0.0.26

|

IT41069

|

Interim fix for APAR (IT41069) is available from

IBM Fix Central

IBM App Connect Enterprise

|

v11.0.0.0 -v11.0.0.17

|

IT41069

|

This APAR is available in IBM App Connect fixpack 11.0.0.18

IBM App Connect Enterprise

|

v12.0.1.0 - v12.0.4.0

|

IT41069

|

This APAR is available in IBM App Connect fixpack 12.0.5.0

Workarounds and Mitigations

None