Security Bulletin: IBM Java as used in IBM QRadar SIEM is vulnerable to sensitive information leakage. (CVE-2017-10115)

Summary

All applicable CVEs from the Java Quarterly CPU - Jul 2017.

Vulnerability Details

CVE-ID: CVE-2017-10115 **
Description:An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. CVE-2017-10116 **
CVSS Base Score: 7.50**
CVSS Temporal Score:** See https://exchange.xforce.ibmcloud.com/vulnerabilities/128876 for the current score**
CVSS Environmental Score:** Undefined*
CVSS Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products and Versions

· IBM QRadar 7.3 to 7.3.0 Patch 7

· IBM QRadar 7.2 to 7.2.8 Patch 10

Remediation/Fixes

· IBM QRadar/QRM/QVM/QRIF/QNI 7.3.1 GA

· IBM QRadar/QRM/QVM/QRIF/QNI 7.2.8 Patch 11

Workarounds and Mitigations

None