Security Bulletin: There are multiple vulnerabilities in IBM SDK, Java Technology Edition that is shipped with CICS Transaction Gateway for Multiplatforms (CVE-2023-22045 and CVE-2023-22049).

Summary

There are multiple vulnerabilities in IBM SDK, Java Technology Edition that is shipped with CICS Transaction Gateway for Multiplatforms (CVE-2023-22045 and CVE-2023-22049). An update to CICS Transaction Gateway for Multiplatforms has been released to address these vulnerabilities.

Vulnerability Details

CVEID:CVE-2023-22045
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low confidentiality impacts.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261047 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2023-22049
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow a remote attacker to cause low integrity impacts.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261048 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM CICS Transaction Gateway for Multiplatforms	9.1
IBM CICS Transaction Gateway for Multiplatforms	9.2
IBM CICS Transaction Gateway for Multiplatforms	9.3

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading IBM CICS Transaction Gateway for Multiplatforms.

Product	Version	Platform	Remediation/Fix
IBM CICS Transaction Gateway for Multiplatforms

9.1

| AIX|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.1

| Linux on POWER Big Endian|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.1

| Linux on Intel|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.1

| Linux on IBM Z|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.1

| Windows|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.2

| AIX|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.2

| Linux on POWER Big Endian|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.2

| Linux on Intel|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.2

| Linux on IBM Z|

There is a vulnerability in the Java SE.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.2

| Windows|

There is a vulnerability in the Java SE.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.3

| AIX|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.3

| Linux on POWER Big Endian|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.3

| Linux on Intel|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.3

| Linux on Intel container|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.3

| Linux on IBM Z|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.3

| Windows|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

IBM CICS Transaction Gateway for Multiplatforms|

9.3

| Linux on IBM Z container|

There are multiple vulnerabilities in IBM SDK, Java Technology Edition.

Download the upgrade from Fix Central.

Workarounds and Mitigations

None