Security Bulletin: A CVE-2021-37714 vulnerability in jsoup affects IBM Process Designer in IBM Business Automation Workflow and IBM Business Process Manager

Summary

A vulnerabilitiy exists in jsoup used by the desktop version of IBM Process Designer. IBM Process Designer has addressed the applicable CVE.

Vulnerability Details

CVEID:CVE-2021-37714
**DESCRIPTION:**jsoup is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause the HTML and XML parser to get stuck, timeout, or throw unchecked exceptions resulting in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/207858 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Install interim fix JR64213 for your version:

• IBM Business Automation Workflow 21.0.0.2
• IBM Business Automation Workflow 20.0.0.2
• IBM Business Automation Workflow 19.0.0.3
• IBM Business Process Manager 8.6.0.0 CF2018.03
• IBM Business Process Manager Advanced 8.5.7 CF2017.06
• IBM Business Process Manager Standard 8.5.7 CF2017.06
• IBM Business Process Manager Express 8.5.7 CF2017.06

Workarounds and Mitigations

None