Security Bulletin: IBM Kenexa LCMS Premier on Premise| IBM SDK, Java Technology Edition Apr 2018 and Jul 2018 (CVE-2018-2783, CVE-2018-2952, CVE-2018-1517)

Summary

We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. Fixes for these vulnerabilities are included in LCMS Premier version 12.3 and above .

If you have any of the affected versions and are an On Premise customer , please consider upgrading your LCMS Premier sites to version 12.3 and above.

Vulnerability Details

CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could allow an unauthenticated attacker to cause high confidentiality impact, high integrity impact, and no availability impact.
CVSS Base Score: 7.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/141939&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2018-1517 DESCRIPTION: A flaw in the java.math component in IBM SDK, Java Technology Edition may allow an attacker to inflict a denial-of-service attack with specially crafted String data.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/141681&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2018-2952 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Concurrency component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/146815&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product

| Affected Version
—|—

IBM Kenexa LCMS Premier On Premise

| 10.1
IBM Kenexa LCMS Premier On Premise | 10.2
IBM Kenexa LCMS Premier On Premise | 10.3
IBM Kenexa LCMS Premier On Premise | 11.0
IBM Kenexa LCMS Premier On Premise | 11.1
IBM Kenexa LCMS Premier On Premise | 11.2
IBM Kenexa LCMS Premier On Premise | 11.3
IBM Kenexa LCMS Premier On Premise | 12.0
IBM Kenexa LCMS Premier On Premise | 12.1
IBM Kenexa LCMS Premier On Premise | 12.2

Remediation/Fixes

The issue has been fixed in IBM LCMS Premier version 12.3 and up.

IBM recommends updating to the latest release for customers who are using an affected version . To do so you need to download the new version via IBM Passport Advantage.