Security Bulletin: Vulnerability of okio-1.13.0.jar is affecting APM WebSphere Application Server Agent, APM Tomcat Agent, APM SAP NetWeaver Java Stack Agent, APM WebLogic Agent and APM Data Collector for J2SE

Summary

APM WebSphere Application Server Agent, APM Tomcat Agent, APM SAP NetWeaver Java Stack Agent, APM WebLogic Agent and APM Data Collector for J2SE are vulnerable to okio-1.13.0.jar CVE-2023-3635. The workaround includes okio-1.13.0.jar upgraded to okio-3.5.0.jar .

Vulnerability Details

CVEID:CVE-2023-3635
**DESCRIPTION:**Okio GzipSource is vulnerable to a denial of service, caused by unhandled exception. By sending a specially crafted gzip buffer, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/260866 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

For APM WebSphere Application Server Agent, APM Tomcat Agent, APM SAP NetWeaver Java Stack Agent and APM Data Collector for J2SE

IBM strongly recommends addressing the vulnerability now by upgrading:

Product Remediation

|

Fix

—|—

APM on-premise

|

APM WebSphere Application Server Agent release 8.1.4.0.21

WAS Agent version: 07.30.14.20

Download the APM Advanced Agents installer from Passport Advantage. Please refer below link for download instructions:

<https://www.ibm.com/docs/en/capmp/8.1.4?topic=advantage-part-numbers&gt;

APM on-premise

|

APM Tomcat Agent release 8.1.4.0.21

Tomcat Agent version: 08.24.03.00

Download the APM Advanced Agents installer from Passport Advantage. Please refer below link for download instructions:

<https://www.ibm.com/docs/en/capmp/8.1.4?topic=advantage-part-numbers&gt;

APM on-premise

|

APM SAP NetWeaver Java Stack Agent release 8.1.4.0.21

SAP NetWeaver Java Stack Agent version: 08.24.03.00

Download the APM Advanced Extension Agents installer from Passport Advantage. Please refer below link for download instructions:

<https://www.ibm.com/docs/en/capmp/8.1.4?topic=advantage-part-numbers&gt;

APM on-premise

|

APM J2SE data collector 8.1.4.0.21

J2SE DC Agent version: 08.24.03.00

Download the APM Advanced Agents installer from Passport Advantage. Please refer below link for download instructions:

<https://www.ibm.com/docs/en/capmp/8.1.4?topic=advantage-part-numbers&gt;

Workarounds and Mitigations

For APM WebLogic Agent please follow the below steps as a workaround:

okio-1.13.0.jar must be upgraded to okio-3.5.0.jar from Maven Repository: Search/Browse/Explore (mvnrepository.com)

Procedure:

Step 1: Stop the agent.

Step 2:

i. For Windows: Navigate to the folder $CANDLEHOME\TMAITM6_x64&lt;dchome>&lt;version>\ttdc\lib\ext

ii. For Linux/AIX/SOL: Navigate to the directory $CANDLEHOME/<dchome>/<version>/ttdc/lib/ext,

where <dchome> would be wbdchome and <version> would be 8.1.4.0.0 for WebLogic Agent.

Step 3: Take the backup of okio-1.13.0.jar. Replace existing okio-1.13.0.jar with okio-3.5.0.jar.

Step 4: Start the agent.