Security Bulletin: A Security vulnerability has been identified in Apache HTTP Server used by Rational Build Forge. (CVE-2017-9798)

Summary

Apache HTTP Server has security vulnerability caused due to error in the HTTP Option method. Respective security vulnerability is discussed in detail in the subsequent section.

Vulnerability Details

CVEID: CVE-2017-9798**
DESCRIPTION:**Apache HTTP Server could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending an OPTIONS HTTP request, a remote attacker could exploit this vulnerability to obtain sensitive information. **CVSS Base Score:**7.5 **CVSS Temporal Score: **See https://exchange.xforce.ibmcloud.com/vulnerabilities/132159 for the current score. *CVSS Environmental Score:**Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM Rational Build Forge from 8.0.0.6.

Remediation/Fixes

You must download the Fix pack specified in the following table and apply it.

Affected Version |

Fix
—|—

Build Forge 8.0.0.6 |

Rational Build Forge 8.0.0.7 Download.

Workarounds and Mitigations

None.