Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Process Designer used in IBM Business Automation Workflow, IBM Business Process Manager, and IBM WebSphere Lombardi Edition

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6 and 7used by IBM Process Designer. IBM Process Designer has addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2018-3139 **DESCRIPTION:*An unspecified vulnerability related to the Java SE Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/151455&gt; for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-3180 DESCRIPTION: An unspecified vulnerability related to the Java SE JSSE component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and low availability impact.
CVSS Base Score: 5.6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/151497&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2018-11212 DESCRIPTION: libjpeg is vulnerable to a denial of service, caused by divide-by-zero error in the alloc_sarray function in jmemmgr.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 3.3
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/143429&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2019-2426 DESCRIPTION: An unspecified vulnerability related to the Java SE Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/155744&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2018-12547 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a buffer overflow, caused by improper bounds checking by the jio_snprintf() and jio_vsnprintf() functions. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 9.8
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/157512&gt;_ for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM Business Automation Workflow 18.0.0.1, 18.0.0.2, 19.0.0.1
IBM Business Process Manager 8.6.0.0 - 8.6.0.0 CF2018.03
IBM Business Process Manager 8.5.7 - 8.5.7 CF2017.06
IBM Business Process Manager 8.5.6.0 - 8.5.6.0 CF02
IBM Business Process Manager 8.5.5.0
IBM Business Process Manager 8.5.0.0 - 8.5.0.2
IBM Business Process Manager 8.0.0.0 - 8.0.1.3
IBM Business Process Manager 7.5.0.0 - 7.5.1.2
WebSphere Lombardi Edition Process Designer 7.2.0.0 - 7.2.0.5

Remediation/Fixes

Install theinterim fix** **JR60723 that applies to your version:

• IBM Business Automation Workflow 19.0.0.1
• IBM Business Automation Workflow 18.0.0.2
• IBM Business Automation Workflow 18.0.0.1
• IBM Business Process Manager 8.6.0.0 CF2018.03
• IBM Business Process Manager 8.6.0.0 CF2017.12
• IBM Business Process Manager Express 8.6.0.0 CF2017.12
• IBM Business Process Manager Advanced 8.5.7 CF2017.06
• IBM Business Process Manager Standard 8.5.7 CF2017.06
• IBM Business Process Manager Express 8.5.7 CF2017.06

Because support for Java 6 with Business Process Manager ended, if you are on earlier version of IBM Business Process Manager or WebSphere Lombardi Edition, upgrade to IBM Business Process Manager V8.5.7.0 2017.06 or later or IBM Business Automation Workflow and then apply interim fix JR60723.

Workarounds and Mitigations

None