Security Bulletin: Open Source Apache CXF Vulnerablities affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2018-8039)

Summary

Vulnerabilities in Open Source Apache CXF affect IBM Tivoli Application Dependency Discovery Manager

Vulnerability Details

CVE-ID:CVE-2018-8039
DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work correctly with com.sun.net.ssl interface. An attacker could exploit this vulnerability to launch a man-in-the-middle attack.
CVSS Base Score: 7.5
CVSS Temporal Score: _<https://exchange.xforce.ibmcloud.com/vulnerabilities/145516&gt;_ for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

TADDM 7.3.0.2 - 7.3.0.5

Remediation/Fixes

There is an eFix prepared on top of the latest released FixPack for TADDM 7.3.0.

efix_TADDM73_CXF3116_FP420171214.zip

| 7.3.0.2-7.3.0.5 | None | Download eFix

Please get familiar with eFix readme in etc/<efix_name>_readme.txt