Security Bulletin: Vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Jul 2019 - Includes Oracle Jul 2019 CPU

2019-10-2919:34:34

www.ibm.com

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

Summary

There are vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Jul 2019 - Includes Oracle Jul 2019 CPU used by IBM Streams. IBM Streams has addressed the applicable CVEs.

Vulnerability Details

CVE-2019-2769 (CVSS 5.3)DescriptionA flaw in the java.util component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product ApplicabilityThis issue is applicable if the JRE deserializes serialized object data from untrusted sources.
MitigationThe only solution is to upgrade the JRE.
CVE-2019-2762 (CVSS 5.3)DescriptionA flaw in the java.lang component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product ApplicabilityThis issue is applicable if the JRE deserializes serialized object data from untrusted sources.
MitigationThe only solution is to upgrade the JRE.
CVE-2019-2745 (CVSS 5.1)DescriptionEC keys can be extracted via side-channel attacks.

Affected Products and Versions

IBM Streams	4.1.1.9 and earlier
IBM Streams	4.2.1.7 and earlier
IBM Streams	4.3.1.0 and earlier

Remediation/Fixes

NOTE: Fix Packs are available on IBM Fix Central.

To remediate/fix this issue, follow the instructions below:

Version 4.3.x: Apply _ 4.3.0 Fix Pack 1 (4.3.1.1) or higher_ .
Version 4.2.x: Apply 4.2.1 Fix Pack 4 (4.2.1.8) or higher .
Version 4.1.x: Apply 4.1.1 Fix Pack 6 (4.1.1.10) or higher

Versions 4.0.x, 3.2.x, 3.1.x, and 3.0.x: For versions earlier than 4.x.x, IBM recommends upgrading to a fixed, supported version/release/platform of the product. Customers who cannot upgrade and need to secure their installation should open a PMR with IBM Technical Support and request assistance securing their InfoSphere Streams system against the vulnerabilities identified in this Security Bulletin.