Security Bulletin: CVE-2019-4732 vulnerabilitiy in IBM Java Runtime affects IBM Process Designer used in IBM Business Automation Workflow and IBM Business Process Manager

Summary

A vulnerabilitiy exists in IBM® Runtime Environment Java™ Versions 6 and 7 used by the desktop version of IBM Process Designer. IBM Process Designer has addressed the applicable CVE.

Vulnerability Details

CVEID:CVE-2019-4732
**DESCRIPTION:**IBM SDK, Java Technology Edition Version could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172618 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

Install interim fix JR61918 for your version:

• IBM Business Automation Workflow 19.0.0.3
• IBM Business Automation Workflow 19.0.0.2
• IBM Business Process Manager 8.6.0.0 CF2018.03
• IBM Business Process Manager Advanced 8.5.7 CF2017.06
• IBM Business Process Manager Standard 8.5.7 CF2017.06
• IBM Business Process Manager Express 8.5.7 CF2017.06

Workarounds and Mitigations

None