Security Bulletin: Rational Build Forge Security Advisory for Apache Tomcat and Apache HTTP Server (CVE-2018-11763; CVE-2018-11784)

Summary

Apache Tomcat and Apache HTTP Server have security vulnerabilities that allows a remote attacker to exploit the application. Respective security vulnerabilities are discussed in detail in the subsequent sections.

Vulnerability Details

This section includes the vulnerability details that affects the Rational Build Forge.

CVEID: CVE-2018-11784 **DESCRIPTION:*Apache Tomcat could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the default servlet. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a user to arbitrary websites. CVSS Base Score: 7.4 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/150860&gt;_ for the current score. CVSS Environmental Score: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)

CVEID: CVE-2018-11763 **DESCRIPTION:*Apache HTTP Server is vulnerable to a denial-of-service. When a client sending continuous large SETTINGS frames of maximum size to maintain the ongoing HTTP/2 connection busy, a remote attacker could exploit this vulnerability to cause the service to fail connection timeout. CVSS Base Score: 3.7 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/150420&gt;_ for the current score. CVSS Environmental Score: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

IBM Rational Build Forge from 8.0.0.9.

Remediation/Fixes

You must download the Fix pack specified in the following table and apply it.

Affected Supporting Product

|

Remediation/Fix

—|—

IBM Rational Build Forge 8.0.0.10

| Rational Build Forge 8.0.0.10 Download.

Workarounds and Mitigations

None.