IBMD3B133708F33645D7DA98DC3F0D26FB311C0A7F5300FC6005D1121DF12BE9266Security Bulletin: IBM Sterling Partner Engagement Manager vulnerable to buffer overflow due to OpenJDK (CVE-2023-2597)
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
0.001 Low
EPSS
Percentile
48.3%
Summary
The vulnerability in open JDK that is shipped with IBM Sterling Partner Engagement Manager. The CVE(s) listed in this document are addressed.
Vulnerability Details
CVEID:CVE-2023-2597
**DESCRIPTION:**Eclipse Openj9 is vulnerable to a buffer overflow, caused by improper bounds checking by the getCachedUTFString() function. By using specially crafted input, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/255906 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Sterling Partner Engagement Manager | 6.2.1 |
| IBM Sterling Partner Engagement Manager | 6.2.2 |
| IBM Sterling Partner Engagement Manager | 6.1.2 |
| IBM Sterling Partner Engagement Manager | 6.2.0 |
Remediation/Fixes
Workarounds and Mitigations
None
Affected configurations
Related
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
0.001 Low
EPSS
Percentile
48.3%