IBM8048C8FCE2DA85F0D1955A6FB90D2AD3EAC0065392BEED41EBB089722237CA8BSecurity Bulletin: IBM Java Runtime (JRE) security vulnerabilities CVE-2023-21830, CVE-2023-21843 in FileNet Content Manager
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
42.5%
Summary
Security Bulletin: IBM Java Runtime (JRE) security vulnerabilities CVE-2023-21830, CVE-2023-21843 in FileNet Content Manager, affected, but not vulnerable
Vulnerability Details
CVEID:CVE-2023-21830
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Serialization component could allow a remote attacker to cause a denial of service resulting in a low integrity impact using unknown attack vectors.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/245038 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID:CVE-2023-21843
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Sound component could allow a remote attacker to cause a denial of service resulting in a low integrity impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/245037 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| FileNet Content Manager | 5.5.4.0 |
| FileNet Content Manager | 5.5.8.0 |
| FileNet Content Manager | 5.5.9.0 |
Remediation/Fixes
To resolve these vulnerabilities, install IBM Java 8.0.8.0 or higher.
| Product | VRMF | APAR | Remediation/First Fix |
|---|---|---|---|
| FileNet Content Manager | 5.5.4.0 | PJ47048 | |
| PJ47048 | 5.5.4.0-P8CPE-IF010 - 6/27/2023 | ||
| 5.5.4.0-P8CSS-IF010 - 6/27/2023 | |||
| FileNet Content Manager | 5.5.8.0 | PJ47048 | |
| PJ47048 | 5.5.8.0-P8CPE-IF005 - 8/30/2023 | ||
| 5.5.8.0-P8CSS-IF005 - 8/30/2023 | |||
| FileNet Content Manager | 5.5.9.0 | PJ47048 | |
| PJ47048 | 5.5.9.0-P8CPE-IF003 - 7/14/2023 | ||
| 5.5.9.0-P8CSS-IF003 - 7/14/2023 |
In the above table, the APAR links will provide more information about the fix.
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| filenet content manager | eq | 5.5.4 | |
| filenet content manager | eq | 5.5.8 | |
| filenet content manager | eq | 5.5.9 |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
42.5%