Security Bulletin: Vulnerability in IBM Java Runtime affects Financial Transaction Manager for ACH Services, Financial Transaction Manager for Check Services, Financial Transaction Manager for Corporate Payment Services,

Summary

There is a vulnerability in IBM® Runtime Environment Java™ Version 1.7 used by Financial Transaction Manager (FTM) for ACH Services, FTM for Check Services, FTM for Corporate Payment Services (CPS), These issues were disclosed as part of the IBM Java SDK updates in October 2017.

Vulnerability Details

CVEID: CVE-2017-10356**
DESCRIPTION:** An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/133785&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

- FTM for ACH Services v3.0.2.1, v3.0.3.0, v3.0.4.1, v3.1.0.0

- FTM for Check Services v3.0.0.x, v3.0.2.1

- FTM for CPS v3.0.2.1

Remediation/Fixes

Product

| VRMF| APAR| Remediation/First Fix
—|—|—|—
FTM for ACH Services| 3.0.2.1,
3.0.3.0
3.0.4.1,
v3.1.0.0| PI92775| 3.0.2.1 apply 3.0.2.1-FTM-ACH-MP-iFix0008 or later.
3.0.3.0 apply 3.0.3.0-FTM-ACH-MP-iFix0005 or later.
3.0.4 apply 3.0.4.1-FTM-ACH-MP-iFix0001 or later
3.1.0 apply 3.1.0.0-FTM-ACH-MP-iFix0002 or later
FTM for Check Services| 3.0.0.x
3.0.2.1| PI92775| 3.0.0 apply 3.0.0.15-FTM-Check-MP-iFix0014 or later.
3.0.2.1 apply 3.0.2.1-FTM-Check-MP-iFix0008 or later.
FTM for CPS| 3.0.2.1| PI92775| 3.0.2.1 apply 3.0.2.1-FTM-CPS-MP-iFix0008 or later.

Workarounds and Mitigations

None