Security Bulletin: A security vulnerability affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition (CVE-2019-4398)

Summary

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise has identified and addressed the session management cookies vulnerability.

Vulnerability Details

CVEID: CVE-2019-4398 DESCRIPTION: IBM Cloud Orchestrator could allow a local user to obtain sensitive information from SessionManagement cookies.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/162259&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5, 2.5.0.1, 2.5.0.2, 2.5.0.3, 2.5.0.4, 2.5.0.5, 2.5.0.6, 2.5.0.7, 2.5.0.8, 2.5.0.9

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.4, 2.4.0.1, 2.4.0.2, 2.4.0.3, 2.4.0.4, 2.4.0.5

Remediation/Fixes

The recommended solution is to apply the fixes as soon as practical.

For 2.5 versions, IBM recommends upgrading to Fix Pack 10 (2.5.0.10) of IBM Cloud Orchestrator.

<https://www.ibm.com/support/pages/ibm-cloud-orchestrator-fix-pack-10-25010-25&gt;

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise | 2.4, 2.4.0.1, 2.4.0.2, 2.4.0.3, 2.4.0.4, 2.4.0.5 |

Contact IBM Cloud Orchestrator support.

Workarounds and Mitigations

None