Security Bulletin: IBM SDK, Java Technology Edition, Security Update August 2023

2023-09-0515:25:02

www.ibm.com

ibm sdk java technology edition

unsafe deserialization flaw

remote code execution

rational application developer 9.6

rational application developer 9.7

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.006

Percentile

78.0%

JSON

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, 8* that is used by Rational Application Developer®. These issues were disclosed as part of the IBM Java SDK updates up to August 2023. IBM 8 SR8 FP5 (1.8.0_371).

Vulnerability Details

CVEID:CVE-2022-40609
**DESCRIPTION:**IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/236069 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
Rational Application Developer	9.6
Rational Application Developer	9.7

Remediation/Fixes

https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FRational%2FIBM+Rational+Application+Developer+for+WebSphere+Software&fixids=Rational-RAD-Java8SR8FP5_RAD_RSA-ifix&source=SAR

An additional setting is required to make WAS administrative connections work after applying the fix. Please follow Technote

https://www.ibm.com/support/pages/node/6584349

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmrational_application_developer_for_websphere_softwareMatch9.6

ibmrational_application_developer_for_websphere_softwareMatch9.7

VendorProductVersionCPE
ibmrational_application_developer_for_websphere_software9.6cpe:2.3:a:ibm:rational_application_developer_for_websphere_software:9.6:*:*:*:*:*:*:*
ibmrational_application_developer_for_websphere_software9.7cpe:2.3:a:ibm:rational_application_developer_for_websphere_software:9.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	rational_application_developer_for_websphere_software	9.6	cpe:2.3:a:ibm:rational_application_developer_for_websphere_software:9.6:::::::*
ibm	rational_application_developer_for_websphere_software	9.7	cpe:2.3:a:ibm:rational_application_developer_for_websphere_software:9.7:::::::*