Security Bulletin: Multiple Security Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM License Key Server Administration & Reporting Tool and Agent

Summary

Multiple Security Vulnerabilities in IBM WebSphere Application Server Liberty, used by IBM License Key Server Administration & Reporting Tool and Agent, has been published. IBM License Key Server Administration & Reporting Tool and Agent team has come up with a remediation.

Vulnerability Details

CVEID: CVE-2019-4046 DESCRIPTION: IBM WebSphere Application Server is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to cause the consumption of Memory.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/156242&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2018-1902 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/152531&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

• IBM License Key Server Administration & Reporting Tool version 8.1.5

• IBM License Key Server Administration & Reporting Tool version 8.1.5.1

• IBM License Key Server Administration & Reporting Tool version 8.1.5.2

• IBM License Key Server Administration & Reporting Tool version 8.1.5.3

• IBM License Key Server Administration & Reporting Tool version 8.1.5.4

• IBM License Key Server Administration & Reporting Tool version 8.1.5.5

• IBM License Key Server Administration & Reporting Tool version 8.1.5.6

• IBM License Key Server Administration & Reporting Tool version 8.1.6

• IBM License Key Server Administration Agent version 8.1.5

• IBM License Key Server Administration Agent version 8.1.5.1

• IBM License Key Server Administration Agent version 8.1.5.2

• IBM License Key Server Administration Agent version 8.1.5.3

• IBM License Key Server Administration Agent version 8.1.5.4

• IBM License Key Server Administration Agent version 8.1.5.5

• IBM License Key Server Administration Agent version 8.1.5.6

• IBM License Key Server Administration Agent version 8.1.6

Remediation/Fixes

Upgrade the IBM License Key Server Administration & Reporting Tool to version 8.1.6.1. It can be downloaded from here.

Upgrade the IBM License Key Server Administration Agent to version 8.1.6.1. It can be downloaded from here.

Workarounds and Mitigations

None