Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM Cognos Command Center

Summary

There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by IBM Cognos Command Center. These issues were disclosed as part of the IBM Java SDK update for July 2021 and April 2021 as well as CVE-2020-14782 (defered from October 2020 IBM Java SDK update).

Vulnerability Details

CVEID:CVE-2020-14782
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190100 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2021-2369
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Library component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/205796 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID:CVE-2021-2341
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/205768 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID:CVE-2021-2161
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity impact, and no availability impact.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200290 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

IBM Cognos Command Center 10.2.4.1

Remediation/Fixes

The recommended solution is to apply IBM JRE 8.0.6.35 to your version of IBM Cognos Command Center.

The fixes can be found here:

IBM Cognos Command Center 10.2.4.1 JRE 80SR6FP35

Installation Instructions:

**For IBM Cognos Command Center version 10.2.4.1 **

Step 1:
Download the 64 bit IBM Java JRE (file name: ibm-java-jre-80-win-x86_64.zip, Build: pwa6480sr6fp35-20210714_01 (SR6FP35)
Step 2:
Stop the CccServer, CccQueue and CccAgent Microsoft Windows services.
Step 3:
Rename the <INSTALLDIR>\Common\java.8.0.0 directory to <INSTALLDIR>\Common\java.8.0.0.orig
Step 4:
Unpack the content of the ibm-java-sdk-80-win-x86_64.zip file to <INSTALLDIR>\Common\java.8.0.0
Step 5:
Start the CccAgent, CccQueue and CccServer Microsoft Windows services.
Step 6:
Validate the installation by testing the connectivity to the agent using the CCC Client.

Workarounds and Mitigations

None