Security Bulletin: IBM InfoSphere Global Name Management Vulnerable to CVE-2023-30441

Summary

InfoSphere Global Name Management bundles IBM Java as internal component. A combination of two flaws in the JSSE component and IBMJCEPlus security provider expose some IBM Java releases to various cryptographic attacks when acting as a TLS server. This vulnerability is addressed.

Vulnerability Details

CVEID:CVE-2023-30441
**DESCRIPTION:**IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253188 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Per the original bulletin, this is resolved in IBM Java version 8.0.7.15 or later. GNM customers are advised to apply an interim fix that, among other things, updates the IBM Java in GNM to version 8.0.8.0 or later. Specifically:

• For GNM version 7, update using the files and instructions in GNM 7 interim fix 006, available at IBM fix central.
• For GNM version 6, update using the files and instructions in GNM 6 interim fix 015, available at IBM fix central.

Workarounds and Mitigations

None