Security Bulletin: A vulnerability in Bouncy Castle affect IBM Watson Machine Learning Accelerator

Summary

A vulnerability exists in the Bouncy Castle version used by IBM Watson Machine Learning Accelerator. Bouncy Castle upgrade to version 1.69 which resolves these vulnerabilities, is available on IBM Fix Central.

Vulnerability Details

CVEID:CVE-2020-15522
**DESCRIPTION:**Bouncy Castle BC Java, BC C# .NET, BC-FJA, BC-FNA could allow a remote attacker to obtain sensitive information, caused by a timing issue within the EC math library. By utilize cryptographic attack techniques, an attacker could exploit this vulnerability to obtain the private key information, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202188 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

For 2.x.x version, Fixed in IBM Watson Machine Learning Accelerator 2.3.1, please reference the upgrade section in <https://www.ibm.com/docs/en/cloud-paks/cp-data/3.5.0?topic=accelerator-upgrading-watson-machine-learning&gt;

For 1.x.x version,

Download IBM interim fix dli-1.2.3-build600543-wmla from the following location <http://www.ibm.com/eserver/support/fixes/&gt;.

Follow the instructions in the downloaded README file to apply the IBM interim fix dli-1.2.3-build600543-wmla to the IBM Watson Machine Learning Accelerator version 1.2.3.

Note:

For IBM Watson Machine Learning Accelerator version 1.2.1 and 1.2.2, follow the IBM Docs <https://www.ibm.com/docs/en/wmla&gt; to upgrade to version 1.2.3, then apply the IBM interim fix dli-1.2.3-build600543-wmla.

Workarounds and Mitigations

None