Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11.

Summary

There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, which are used by IBM Integration Bus & IBM App Connect Enterprise v11. These issues were disclosed as part of the IBM Java SDK updates in October 2020

Vulnerability Details

CVEID:CVE-2020-14779
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190097 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2020-14797
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190115 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM App Connect Enterprise V11 , V11.0.0.0 - V11.0.0.11

IBM Integration Bus V10.0.0.0 - V10.0.0.23

IBM Integration Bus V9.0.0.0 - V9.0.0.11

Remediation/Fixes

Product

|

VRMF

| APAR |

Remediation / Fix

—|—|—|—
IBM App Connect Enterprise V11 | V11.0.0.0 - V11.0.0.11 | IT35151 |

Interim fix for APAR IT35151 is available here

on IBM Fix Central for all the platforms.

IBM Integration Bus | V10.0.0.0 - V10.0.023 | IT35151 |

Interim fix for APAR IT35151 is available here

on IBM Fix Central for all the platforms.

IBM Integration Bus | V9.0.0.0 - V9.0.0.11 | IT35151 | Contact IBM support to request for Fix APAR

_IBM Integration Bus V9 is no longer in full support; IBM recommends upgrading to a fixed, supported version/release/platform of the product. _
If you are a customer with extended support and require a fix, contact IBM support.

Workarounds and Mitigations

None