Security Bulletin: Multiple vulnerabilities in Akka affect IBM Application Performance Management products.

Summary

Akka actor jar is used by IBM Application Performance Management. The vulnerabilities in the product component have been addressed.

Vulnerability Details

CVEID:CVE-2017-1000034
**DESCRIPTION:**Akka could allow a remote attacker to execute arbitrary code on the system, caused by a Java deserialization flaw in the Remoting component. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/130366 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM Cloud Application Performance Management, Base Private

IBM Cloud Application Performance Management, Advanced Private| 8.1.4|

The vulnerability can be remediated by applying the following 8.1.4.0-IBM-APM-SERVER-IF0014 or later server patch to the system where the Cloud APM server is installed: <https://www.ibm.com/support/pages/node/7028410&gt;

—|—|—

Workarounds and Mitigations

None