Security Bulletin: IBM TNPM Wireline is vulnerable to Apache Commons Beanutils (CVE-2019-10086)

Summary

There is a vulnerability in Apache Commons Beanutils that is used by IBM TNPM Wireline . This has been addressed.

Vulnerability Details

CVEID:CVE-2019-10086
**DESCRIPTION:**Apache Commons Beanutils could allow a remote attacker to gain unauthorized access to the system, caused by the failure to suppresses the class property in bean introspection by default. An attacker could exploit this vulnerability to gain unauthorized access to the classloader.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166353 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

• For TNPM Wireline 1.4.0****** **
  Apply TNPM Wireline DataView interim fix IF0066 or later

• For TNPM Wireline 1.4.1****

Apply TNPM Wireline DataView interim fix IF0034 or later

• For TNPM Wireline 1.4.2

** **Apply TNPM Wireline DataView interim fix IF0025 or later

• For TNPM Wireline 1.4.3

** **Apply TNPM Wireline DataView interim fix IF0018 or later

• For TNPM Wireline 1.4.4

Apply TNPM Wireline DataView interim fix IF0007 or later

Workarounds and Mitigations

None