Security Bulletin: An issue was identified with IBM® Runtime Environment Java™ Technology Edition, Version 8 supplied by IBM MQ (CVE-2021-2163)

Summary

An issue was identified with IBM® Runtime Environment Java™ Technology Edition, Versions 7 and 8 supplied by IBM MQ versions.

The IBM® Runtime Environment Java™ Technology Edition, Version 8 is used for Java Client, JMS Client, AMQP, MQTT, Blockchain Bridge, Salesforce Bridge, Java AMS, MQ Explorer, MQ Console, and MQ REST API functionality, by IBM MQ 9.0, 9.1, 9.2 and 9.3.

The IBM® Runtime Environment Java™ Technology Edition, Version 7 is used for Java Client, JMS Client, AMQP, MQTT, Java AMS, and MQ Explorer functionality, by IBM MQ 8.

Vulnerability Details

CVEID:CVE-2021-2163
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity impact, and no availability impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200292 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

This issue was resolved in APAR IT42100.

IBM MQ 8.0

Apply iFix for APAR IT42100

IBM MQ 9.0 LTS

Apply iFix for APAR IT42100

IBM MQ 9.1 LTS

Apply FixPack 9.1.0.12

IBM MQ 9.2 LTS

Apply FixPack 9.2.0.7

IBM MQ 9.3 LTS

Apply FixPack 9.3.0.2

IBM MQ 9.1 CD, 9.2 CD and 9.3 CD

Upgrade to IBM MQ 9.3.1

Workarounds and Mitigations

None