Security Bulletin: Vulnerabilities in WebSphere Liberty Profile affect IBM InfoSphere Global Name Management (CVE-2020-5258, CVE-2020-4590, CVE-2020-4421)

Summary

There are multiple vulnerabilities in the WebSphere Liberty Profile used in IBM InfoSphere Global Name Management (GNM).

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Note that CVE-2020-4590 and CVE-2020-4421 do not affect GNM as normally installed. They would only apply if the customer chose to manually modify their WebSphere Liberty configuration to enable and use the oauth-2.0 and/or openid connect feature, which is not a common modification. Only CVE-2020-5258 affects GNM as normally installed.

Remediation/Fixes

Per the original bulletins for CVE-2020-5258, CVE-2020-4590, and CVE-2020-4421, all three vulnerabilities can be resolved by upgrading WebSphere Liberty Profile.

• For basic GNM (the regular version used by most customers) versions 6 and 7, upgrade to WebSphere Liberty Profile version 21.0.0.10 or later, available at IBM Fix Central.
• For GNM version 6 Enterprise Name Search (a separate installation which does not apply to most customers), update using the files and instructions in GNM 6 interim fix 11, available at IBM Fix Central.

Workarounds and Mitigations

None