Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server Liberty shipped with IBM PureApplication System

Summary

IBM WebSphere Application Server Liberty is shipped as a component of IBM PureApplication System. Information about security vulnerabilities affecting IBM WebSphere Application Server Liberty have been published in security bulletins (CVE-2016-0378, CVE-2016-3040, CVE-2016-3042).

Vulnerability Details

Consult the security bulletin

· _Security Bulletin: Information Vulnerability Disclosure in IBM WebSphere Application Server Liberty (CVE-2016-0378) _

· _Security Bulletin: Open Redirect vulnerability in WebSphere Application Server Liberty (CVE-2016-3040) _

· _Security Bulletin: Cross-site scripting vulnerability in WebSphere Application Server Liberty (CVE-2016-3042) _

for vulnerability details and information about fixes.

The WebSphere fixes can be installed using the IBM PureApplication System’s Installation Manager Repository feature.

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
PureApplication System versions 2.1, and 2.2| This vulnerability affects IBM WebSphere Application Server Liberty.

For earlier unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.