Security Bulletin: XML External Entity Injection vulnerability in IBM Business Automation Workflow and IBM Business Process Manager (BPM) (CVE-2019-4424)

Summary

An XML External Entity Injection vulnerability in IBM Business Automation Workflow and IBM BPM has been found.

Vulnerability Details

CVEID: CVE-2019-4424 DESCRIPTION: IBM Business Automation Workflow is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS Base Score: 7.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/162770&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)

Affected Products and Versions

- IBM Business Automation Workflow V18.0.0.0 through V19.0.0.2

- IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03

- IBM Business Process Manager V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06

- IBM Business Process Manager V8.5.6.0 through V8.5.6.0 CF2

- IBM Business Process Manager V8.5.5.0

- IBM Business Process Manager V8.5.0.0 through V8.5.0.2

- IBM Business Process Manager V8.0.0.0 through V8.0.1.3

- IBM Business Process Manager V7.5.0.0 through V7.5.1.2

Remediation/Fixes

Install interim fix JR61232 as appropriate for your current IBM Business Automation Workflow or IBM BPM version.

• IBM Business Automation Workflow
• IBM Business Process Manager Advanced
• IBM Business Process Manager Standard
• IBM Business Process Manager Express

For IBM Business Automation Workflow V18.0.0.0 through V19.0.0.2
· Upgrade to at least IBM Business Automation Workflow V18.0.0.1 as required by iFix and then apply iFix JR61232
--OR–
· Apply cumulative fix IBM Business Automation Workflow V19.0.0.3

For IBM BPM V8.6.0.0 through V8.6.0.0 CF 2018.03
· Upgrade to at least IBM BPM V8.6.0.0 CF 2017.12 as required by iFix and then apply iFix JR61232

For IBM BPM V8.5.7.0 through V8.5.7.0 CF 2017.06
· Apply Cumulative Fix 2017.06 and then apply iFix JR61232

For IBM BPM V8.5.6.0 through V8.5.6.0 CF2
· Apply CF2 as required by iFix and then apply iFix JR61232

For IBM BPM V8.5.5.0
· Apply iFix JR61232

For IBM BPM V8.5.0.0 through V8.5.0.2
· Install Fix Pack 2 as required by iFix and then apply iFix JR61232

For IBM BPM V8.0.0.0 through V8.0.1.3

· Upgrade to minimal Refresh Pack 1, install Fix Pack 3 as required by iFix and then apply iFix JR61232

For IBM BPM V7.0.0.0 through V7.5.1.2

· Upgrade to minimal Refresh Pack 1, install Fix Pack 2 as required by iFix and then apply iFix JR61232

As IBM Business Process Manager V7.5 and V8.0 are out of general support, customers with a support extension contract can contact IBM support to request the fix.

Workarounds and Mitigations

None