Security Bulletin: The IBM® Engineering Lifecycle Engineering products using Liberty are vulnerable to denial of service due to GraphQL Java CVE-2022-37734

2022-12-2304:54:02

www.ibm.com

JSON

Summary

The IBM® Engineering Lifecycle Engineering products using Liberty are vulnerable to denial of service due to GraphQL Java, affected features are mpGraphQL-1.0 or mpGraphQL-2.0 .

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
Global Configuration Management (GCM)	All
Rational DOORS Next Generation (RDNG)	6.0.6
Collaborative Lifecycle Management (CLM)
Rational Team Concert (RTC)
Rational DOORS Next Generation (RDNG)	6.0.6.1
Collaborative Lifecycle Management (CLM)
Rational Team Concert (RTC)
IBM Engineering Requirements Management DOORS Next(DNG)	7, 7.0.1, 7.0.2
Engineering Lifecycle Management (ELM)
IBM Engineering Workflow Management (EWM)

Remediation/Fixes

If your product is deployed on Liberty 17.0.0.3 - 22.0.0.11, please follow the instruction given in the following Liberty bulletin <https://www.ibm.com/support/pages/node/6832094>

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm engineering lifecycle management baseeq6.0.6
ibm engineering lifecycle management baseeq6.0.6.1
ibm engineering lifecycle management baseeq7.0
ibm engineering lifecycle management baseeq7.0.1
ibm engineering lifecycle management baseeq7.0.2

Name	Operator	Version
ibm engineering lifecycle management base	eq	6.0.6
ibm engineering lifecycle management base	eq	6.0.6.1
ibm engineering lifecycle management base	eq	7.0
ibm engineering lifecycle management base	eq	7.0.1
ibm engineering lifecycle management base	eq	7.0.2

JSON

Related for 89673DBF050B3567750CF4151F593E9D77B8E2E91B7F6BDBDADF8DA7AA0EAD55