There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM PureApplication System. These issues were disclosed as part of the IBM Java SDK updates in October 2016.
CVEID: CVE-2016-5542**
DESCRIPTION:** An unspecified vulnerability related to the Libraries component has no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118073 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVEID: CVE-2016-5597**
DESCRIPTION:** An unspecified vulnerability related to the Networking component could allow a remote attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118071 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
IBM PureApplication System V2.2
IBM PureApplication System V2.1
The PureSystems Manager on IBM PureApplication System is affected. The solution is to upgrade the IBM PureApplication System to the following fix level:
IBM PureApplication System V2.2:
Upgrade to IBM PureApplication System V2.2.2.2
IBM PureApplication System V2.1
Upgrade to IBM PureApplication System V2.1.2.4
None