Security Bulletin: Vulnerability in Jasper, Version 8 Service Refresh 5 Fix Pack 33, used in Jetty Server 9.4.14 where Rational Synergy is deployed.

Summary

A security vulnerability in Jasper, Version 8 Service Refresh 5 Fix Pack 33, used by Jetty versions 9.4.14 is affecting IBM Rational Synergy.

Vulnerability Details

CVEID:CVE-2020-27216
**DESCRIPTION:**Eclipse Jetty could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition in the creation of the temporary subdirectory. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190474 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM Rational Synergy 7.2.2, 7.2.2.1, 7.2.2.2.

Remediation/Fixes

Upgrade to Rational Synergy 7.2.2.3 from IBM Passport Advantage and apply it.

NOTE:

Download the Rational Synergy 7.2.2.3 installation image by referring to the installation platform and its part number in the following list:

• IBM Rational Synergy V7.2.2.3 Linux Informix Multilingual (CC5T9ML)
• IBM Rational Synergy V7.2.2.3 Linux Oracle Multilingual (CC5TAML)
• IBM Rational Synergy V7.2.2.3 Windows Informix Multilingual (CC5TBML)

Workarounds and Mitigations

None.