Security Bulletin: Multiple vulnerabilities in Jasper used in Jetty 8.1.3 Server where Rational Change is deployed

Summary

There are multiple vulnerabilities in Jasper, Version 2 Service Refresh 2 Fix Pack 2, used by Jetty 8.1.3 is affecting IBM Rational Change.

Vulnerability Details

The following are the list of vulnerabilities affecting IBM Rational Change:

CVEID: CVE-2017-7658 DESCRIPTION: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. CVSS Base Score: 6.5 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/145522&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID: CVE-2018-12536 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted URL request to the java.nio.file.InvalidPathException function using an invalid parameter to cause an error message to be returned containing the full installation path. An attacker could use this information to launch further attacks against the affected system. CVSS Base Score: 5.3 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/145523&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2017-7656 DESCRIPTION: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw in the HTTP/1.x Parser. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. CVSS Base Score: 6.5 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/145520&gt;_ for the current score. CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID: CVE-2017-7657 DESCRIPTION: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of Chunked Transfer-Encoding chunk size. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. CVSS Base Score: 6.5 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/145521&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID: CVE-2018-18873 DESCRIPTION: JasPer is vulnerable to a denial of service, caused by a NULL pointer dereference in the ras_putdatastd function in ras/ras_enc.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause a denial of service condition. CVSS Base Score: 3.3 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/152318&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-19139 DESCRIPTION: JasPer is vulnerable to a denial of service, caused by a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause the application to crash. CVSS Base Score: 3.3 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/153097&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-20584 DESCRIPTION: JasPer is vulnerable to a denial of service, caused by a flaw when converting the output to jp2 format. By using a specially-crafted input, a remote attacker could exploit this vulnerability to cause the application to hang. CVSS Base Score: 5.3 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/154954&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2018-20570 DESCRIPTION: JasPer is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the jp2_encode function in jp2/jp2_enc.c. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. CVSS Base Score: 5.3 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/154998&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2018-20622 DESCRIPTION: JasPer could allow a remote attacker to obtain sensitive information, caused by a memory leak in base/jas_malloc.c in libjasper.a when “–output-format jp2” is used. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to obtain sensitive information. CVSS Base Score: 3.3 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/155056&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2019-10247 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw in the DefaultHandler. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to obtain sensitive information. CVSS Base Score: 5.3 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/160610&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-12545 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by the additional CPU and memory allocations required to handle changed settings. By sending either large SETTINGs frames container containing many settings, or many small SETTINGs frames, a remote attacker could exploit this vulnerability to cause a denial of service. CVSS Base Score: 7.5 CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/161491&gt;_ for the current score. CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

IBM Rational Change 5.3.1, 5.3.1.1 and 5.3.1.2.

Remediation/Fixes

Product

| VRMF |APAR|Remediation/First Fix
—|—|—|—
Rational Change | 5.3.1, 5.3.1.1, 5.3.1.2. | None. |

Upgrade to Rational Change 5.3.2 supporting Jetty 9.4.14 from IBM Passport Advantage and apply it.

NOTE:

Download the Rational Synergy 7.2.2 installation image by referring to the installation platform and its part number in the following list:

• IBM Rational Change V5.3.2 Multi-platform Multilingual (CC5T0ML) - Windows and Linux included.

Workarounds and Mitigations

None