IBM98282A66297317DEAF932A4DB1AA0BC17518203117E741C6726C9EC569A0FA61Security Bulletin: A vulnerability (CVE-2021-35603) in IBM Java Runtime affects CICS Transaction Gateway
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
3.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
0.002 Low
EPSS
Percentile
53.3%
Summary
IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 is used by CICS Transaction Gateway. The fix removes vulnerability CVE-2021-35603 that can allow an unauthenticated attacker to obtain sensitive information.
Vulnerability Details
CVEID:CVE-2021-35603
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211676 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM CICS Transaction Gateway | v9.2.0.0 – 9.2.0.2 |
| IBM CICS Transaction Gateway | v9.1.0.0 – 9.1.0.3 |
| IBM CICS Transaction Gateway | v9.0.0.0 – 9.0.0.5 |
| IBM CICS Transaction Gateway | v8.1.0.0 – 8.1.0.5 |
| IBM CICS Transaction Gateway | v8.0.0.0 – 8.0.0.6 |
Remediation/Fixes
IBM strongly recommends you apply these fixes
Product
| VRMF|APAR|Remediation / First Fix
—|—|—|—
CICS Transaction Gateway for Multiplatforms| 9.2.0.0
9.2.0.1
9.2.0.2|
Updated JRE’s have been made available on Fix Central as Fix packs.
AIX: 8.0.7-CICSTG-AIXpSeries32-JRE-SR10
xLinux: 8.0.7-CICSTG-Linuxx8632-JRE-SR10
pLinux: 8.0.7-CICSTG-LinuxpSeries32-JRE-SR10
zLinux: 8.0.7-CICSTG-LinuxzSeries31-JRE-SR10
Windows:8.0.7-CICSTG-Windowsx8632-JRE-SR10
| Fix Central Link
CICS Transaction Gateway for Multiplatforms| 9.1.0.0
9.1.0.1
9.1.0.2
9.1.0.3|
Updated JRE’s have been made available on Fix Central as Fix packs.
AIX: 7.1.5-CICSTG-AIXpSeries32-JRE-SR10
xLinux: 7.1.5-CICSTG-Linuxx8632-JRE-SR10
pLinux: 7.1.5-CICSTG-LinuxpSeries32-JRE-SR10
zLinux: 7.1.5-CICSTG-LinuxzSeries31-JRE-SR10
Windows: 7.1.5-CICSTG-Windowsx8632-JRE-SR10
| Fix Central Link
CICS Transaction Gateway for Multiplatforms|
9.0.0.0
9.0.0.1
9.0.0.2
9.0.0.3
9.0.0.4
9.0.0.5
8.1.0.0
8.1.0.1
8.1.0.2
8.1.0.3
8.1.0.4
8.1.0.5
8.0.0.0
8.0.0.1
8.0.0.2
8.0.0.3
8.0.0.4
8.0.0.5
8.0.0.6
| Updated JRE’s have been made available on Fix Central as Fix packs.
Solaris: 7.0.11-CICSTG-SolarisSPARC32-JRE-SR10
AIX: 7.0.11-CICSTG-AIXpSeries32-JRE-SR10
xLinux: 7.0.11-CICSTG-Linuxx8632-JRE-SR10
pLinux: 7.0.11-CICSTG-LinuxpSeries32-JRE-SR10
zLinux: 7.0.11-CICSTG-LinuxzSeries31-JRE-SR10
Windows: 7.0.11-CICSTG-Windowsx8632-JRE-SR10| Fix Central Link
Workarounds and Mitigations
None
Affected configurations
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
3.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
0.002 Low
EPSS
Percentile
53.3%