Security Bulletin: Multiple vulnerabilities in Jackson-databind affect IBM InfoSphere Information Server

Summary

Multiple vulnerabilities in Jackson-databind were addressed by IBM InfoSphere Information Server.

Vulnerability Details

CVEID: CVE-2018-5968 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by deserialization flaws. By using two different gadgets that bypass a blocklist, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/138088 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-17485 DESCRIPTION: Jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the default-typing feature. An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/137340 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2017-7525 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by a deserialization flaw within the Jackson JSON library in the readValue method of the ObjectMapper. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134639 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

The following products, running on all supported platforms, are affected:
IBM InfoSphere Information Analyzer: versions 11.5, and 11.7
IBM InfoSphere DataStage Amazon S3 Connector stage: versions 11.3, 11.5, and 11.7
IBM InfoSphere Information Server on Cloud: versions 11.5, and 11.7

Remediation/Fixes

Product

| VRMF |APAR|Remediation/First Fix
—|—|—|—
InfoSphere Information Analyzer, DataStage Amazon S3 Connector stage, Information Server on Cloud | 11.7 | JR59300 | --Apply IBM InfoSphere Information Server version 11.7.0.1
InfoSphere Information Analyzer, DataStage Amazon S3 Connector stage, Information Server on Cloud | 11.5 | JR59300 |

--Apply IBM InfoSphere Information Server version 11.5.0.2
--Apply IBM InfoSphere Information Server 11.5 Service Pack 4

--Apply IBM InfoSphere DataStage Amazon S3 Connector stage Security Patch
InfoSphere DataStage Amazon S3 Connector stage | 11.3 | JR59300 |

--Apply IBM InfoSphere Information Server version 11.3.1.2

--Apply IBM InfoSphere DataStage Amazon S3 Connector stage Security Patch

Contact Technical Support:
In the United States and Canada dial 1-800-IBM-SERV
View the support contacts for other countries outside of the United States.
Electronically open a Service Request with Information Server Technical Support.

Workarounds and Mitigations

None