Lucene search

K
ibmIBM7AADA2BCD3C437AFA3C3E67E767F613AD2037CB02AF0E9FA64C7DFB2459A1AFC
HistoryDec 09, 2021 - 4:57 p.m.

Security Bulletin: Apr 2020 : Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

2021-12-0916:57:12
www.ibm.com
10

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

65.1%

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2020-2805
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to take control of the system.
CVSS Base score: 8.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179703 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID:CVE-2020-2803
**DESCRIPTION:**An unspecified vulnerability in multiple Oracle products could allow an unauthenticated attacker to take control of the system.
CVSS Base score: 8.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179701 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID:CVE-2020-2781
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Java SE JSSE component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179681 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2020-2757
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Java SE Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179657 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2020-2756
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Java SE Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179656 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM CICS Transaction Gateway 9.1
IBM CICS Transaction Gateway 9.2
IBM CICS Transaction Gateway 9.0
IBM CICS Transaction Gateway 8.1
IBM CICS Transaction Gateway 8.0

Remediation/Fixes

Upgrade the WebSphere Application Server Liberty Core used by CICS TG Gateway daemon. Updated WebSphere Application Server Liberty Core files used by Gateway daemon are made available on Fix Central.

Product VRMF APAR Remediation / First Fix
CICS Transaction Gateway for Multiplatforms 9.2.0.0
9.2.0.1
9.2.0.2 Updated JRE’s have been made available on Fix Central as Fix packs.
AIX: 8.0.6-CICSTG-AIXpSeries32-JRE-SR10
xLinux: 8.0.6-CICSTG-Linuxx8632-JRE-SR10
pLinux: 8.0.6-CICSTG-LinuxpSeries32-JRE-SR10
zLinux: 8.0.6-CICSTG-LinuxzSeries31-JRE-SR10
Windows:8.0.6-CICSTG-Windowsx8632-JRE-SR10
Solaris: 7.0.10-CICSTG-SolarisSPARC32-JRE-SR65 https://www-945.ibm.com/support/fixcentral/swg/identifyFixes?query.parent=ibm~Other%20software&query.product=ibm~WebSphere~CICS%20Transaction%20Gateway%20for%20Multiplatforms&query.release=9.2.0&query.platform=All
CICS Transaction Gateway for Multiplatforms 9.1.0.0
9.1.0.1
9.1.0.2
9.1.0.3 Updated JRE’s have been made available on Fix Central as Fix packs.
AIX: 7.1.4-CICSTG-AIXpSeries32-JRE-SR65
xLinux: 7.1.4-CICSTG-Linuxx8632-JRE-SR65
pLinux: 7.1.4-CICSTG-LinuxpSeries32-JRE-SR65
zLinux: 7.1.4-CICSTG-LinuxzSeries31-JRE-SR65
Windows: 7.1.4-CICSTG-Windowsx8632-JRE-SR65
Solaris: 7.0.10-CICSTG-SolarisSPARC32-JRE-SR65 https://www-945.ibm.com/support/fixcentral/swg/identifyFixes?query.parent=ibm~Other%20software&query.product=ibm~WebSphere~CICS%20Transaction%20Gateway%20for%20Multiplatforms&query.release=9.1.0&query.platform=All
CICS Transaction Gateway for Multiplatforms

9.0.0.0
9.0.0.1
9.0.0.2
9.0.0.3
9.0.0.4

9.0.0.5
8.1.0.0
8.1.0.1
8.1.0.2
8.1.0.3
8.1.0.4
8.1.0.5
8.0.0.0
8.0.0.1
8.0.0.2
8.0.0.3
8.0.0.4
8.0.0.5
8.0.0.6

| Updated JRE’s have been made available on Fix Central as Fix packs.
Solaris: 7.0.10-CICSTG-SolarisSPARC32-JRE-SR65
AIX: 7.0.10-CICSTG-AIXpSeries32-JRE-SR65
xLinux: 7.0.10-CICSTG-Linuxx8632-JRE-SR65
pLinux: 7.0.10-CICSTG-LinuxpSeries32-JRE-SR65
zLinux: 7.0.10-CICSTG-LinuxzSeries31-JRE-SR65
Windows: 7.0.10-CICSTG-Windowsx8632-JRE-SR65 | https://www-945.ibm.com/support/fixcentral/swg/identifyFixes?query.parent=ibm~Other%20software&query.product=ibm~WebSphere~CICS%20Transaction%20Gateway%20for%20Multiplatforms&query.release=9

Workarounds and Mitigations

None

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

65.1%

Related for 7AADA2BCD3C437AFA3C3E67E767F613AD2037CB02AF0E9FA64C7DFB2459A1AFC