Security Bulletin: IBM Sterling Control Center v6.2.x and v6.3.x are vulnerable due to IBM Semeru Runtime vulnerabiliy

Summary

IBM Semeru Runtime Quarterly CPU - Jul 2023 - Includes OpenJDK July 2023 CPU and CVE-2023-22049, CVE-2023-22036, CVE-2023-22006 affecting Sterling Control Center v6.2.1 and v6.3.1.

Vulnerability Details

CVEID:CVE-2023-22049
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow a remote attacker to cause low integrity impacts.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261048 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2023-22036
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Utility component could allow a remote attacker to cause low availability impacts.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261044 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2023-22006
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Networking component could allow a remote attacker to cause low integrity impacts.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261043 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

Product

|

Version

|

Remediation

—|—|—

IBM Sterling Control Center

|

6.3.x GA

|

6.3.1.0 iFix02 Fix Central - 6.3.1.0

IBM Sterling Control Center

|

6.2.x GA

|

6.2.1.0 iFix13 Fix Central - 6.2.1.0

Workarounds and Mitigations

• It is already fixed in 621 ifix13 with java version 8.0.8.20
• It is already fixed in 631 ifix02 with java version 17.0.10.0.
• CVE-2023-22049 - fixed in 8.0.382.0 (semeru),fixed in 17.0.8.0 for semeru 17 ,fixed in 8.0.8.10
• CVE-2023-22036 - N/A for semeru 8,fixed in 17.0.8.0 for semeru 17, Not applicable to IBM 8/JRE
• CVE-2023-22006 - N/A for semeru 8,fixed in 17.0.8.0 for semeru 17, Not applicable to IBM 8/JRE