IBM958D3B4A5A0C1FD39CFF6BC608C4A1729951FA8F9C647E5838B8F638A26061A5Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Rational ClearCase (CVE-2020-4329)
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
Summary
IBM WebSphere Application Server (WAS) is shipped as a component of IBM Rational ClearCase. Information about security vulnerabilities affecting WAS have been published in security bulletins.
Vulnerability Details
Refer to the security bulletin(s) listed in the Remediation/Fixes section
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Rational ClearCase | 8.0.0 |
| IBM Rational ClearCase | 9.0 |
| IBM Rational ClearCase | 9.0.1 |
| IBM Rational ClearCase | 9.0.2 |
| IBM Rational ClearCase | 8.0.1 |
IBM Rational ClearCase, ClearCase Remote Client (CCRC) WAN server component.
Versions 8.0.0.x, 8.0.1.x, 9.0.0.x, 9.0.1.x, 9.0.2.x:
- These vulnerabilities only applies to the CCRC WAN server component, and only for certain levels of WebSphere Application Server.
Remediation/Fixes
Refer to the following security bulletin(s) for vulnerability details and information about fixes addressed by IBM WebSphere Application Server (WAS) which is shipped with IBM Rational ClearCase.
| Principal Product and Version(s) | Affected Supporting Product and Version | Affected Supporting Product Security Bulletin |
|---|---|---|
| IBM Rational ClearCase, versions 8.0.0.x, 8.0.1.x, 9.0.0.x, 9.0.1.x, 9.0.2.x | IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0. |
ClearCase Versions
|
Applying the fix
—|—
8.0.0.x, 8.0.1.x, 9.0.0.x, 9.0.1.x, 9.0.2.x|
- Determine the WAS version used by your CCRC WAN server. Navigate to the CCRC profile directory (either the profile you specified when installing ClearCase, or
<ccase-home>/common/ccrcprofile), then execute the script:bin/versionInfo.sh(UNIX) orbin\versionInfo.bat(Windows). The output includes a section “IBM WebSphere Application Server”. Make note of the version listed in this section. Check your installed version of IBM WebSphere Application Server against this bulletin’s list of vulnerable versions. - Identify the latest available fixes (per the bulletin(s) listed above) for the version of WAS used for CCRC WAN server.
- Apply the appropriate WebSphere Application Server fix directly to your CCRC WAN server host. No ClearCase-specific steps are necessary.
For 8.0.x and earlier releases, IBM recommends upgrading to a fixed, supported version/release/platform of the product.
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| rational clearcase | eq | any |
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N