Security Bulletin: Vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2023-51775, CVE-2024-22329 and CVE-2024-22354)

Summary

WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about a Denial of Service, Server-side Request Forgery and XXE vulnerability affecting WebSphere Application Server have been published in security bulletins.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

For WebSphere Application Server shipped with WebSphere Service Registry and Repository refer to the following security bulletins for vulnerability details and information about fixes:

• Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to a denial of service due to jose4j (CVE-2023-51775)
• Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to server-side request forgery (CVE-2024-22329)
• Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354)

Workarounds and Mitigations

None