Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM SDK, Java Technology Edition Quarterly CPU - Jan 2023 - Includes Oracle January 2023 CPU

Summary

Vulnerabilities may affect IBM® SDK, Java™ Technology Edition. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been addressed in this bulletin: Jazz Foundation, IBM Engineering Workflow Management, Global Configuration Management, IBM Engineering Test Management, IBM Engineering Lifecycle Optimization - Engineering Insights, IBM Engineering Lifecycle Optimization - Publishing, IBM Jazz Reporting Service

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

CVE-2023-21830, CVE-2023-21843 may affect IBM® Engineering Lifecycle Engineering products mentioned above.

If the Product is deployed on one of the above versions, Please follow the instruction given in the following article.

Link - <https://www.ibm.com/support/pages/node/6967213&gt;

All applicable Java SE CVEs published by Oracle as part of their January 2023 Critical Patch Update. See attached documents for full details.

How to update the IBM SDK for Java of Engineering Lifecycle Management products? Please refer below article for more details.

<https://www.ibm.com/support/pages/how-update-ibm-sdk-java-engineering-lifecycle-management-products&gt;

Workarounds and Mitigations

None