Security Bulletin: Vulnerabilities in IBM Java SDK affecting IBM Application Discovery and Delivery Intelligence V5.1.0.7 and V5.1.0.8

Summary

Multiple vulnerabilities are identified in IBM® SDK Java™ Technology Edition Version 1.8 that is used by IBM Application Discovery and Delivery Intelligence V5.1.0.7 and V5.1.0.8 respectively. These issues were disclosed as part of the IBM Java SDK updates in July 2020.

Vulnerability Details

CVEID:CVE-2020-14579
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185057 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2020-14578
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185056 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2020-14577
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185055 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Download the fix pack for the appropriate operating system from ADDI IBM fix packs JRE 8.0.6.16.

Customers need to perform the following steps to apply the fix:

• Stop the ADDI Extension server
• Navigate to the ADDI Extension install directory and rename the JRE folder
  <ADDI Install Dir>/IBM Application Delivery Intelligence/adi<version>/server/jre
  to
  <ADDI Install Dir>/IBM Application Delivery Intelligence/adi<version>/server/jre-original
• This will ensure that the original JRE is kept as a backup if a restore is required
• Extract the new JRE fix pack downloaded above to the ADDI Extension install directory.

<ADDI Install Dir>/IBM Application Delivery Intelligence/adi<version>/server/

• Restart the ADDI Extension server

Workarounds and Mitigations

None