Security Bulletin: Vulnerabilities in IBM Java affect IBM FlashSystem models FS900 and V9000

Summary

Multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition affect the product’s management GUI. The Command Line Interface is unaffected.

Vulnerability Details

CVEID:CVE-2021-35550
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211627 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-35603
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211676 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Storage Node machine type and models (MTMs) affected:

• 9840-AE1 and 9843-AE1
• 9840-AE2 and 9843-AE2
• 9840-AE3, 9843-AE3, and 9843-UF3

Supported storage node code versions which are affected:

• VRMFs prior to 1.5.2.12
• VRMFs prior to 1.6.1.5

**Note:**For information on IBM FlashSystem V9000 SVC code levels affected and remediated, search for the equivalent security bulletin here: IBM Support

Remediation/Fixes

9840-AE1 and 9843-AE1

FlashSystem 900 MTMs:

9840-AE2, 9843-AE2, 9840-AE3, 9843-AE3, and 9843-UF3

Note: AE1 systems are no longer supported.

|

Code fixes are now available, the minimum VRMF containing the fix depending on the code stream:

Fixed Code VRMF:

1.6 stream: 1.6.1.5

1.5 stream: 1.5.2.12

| N/A | FlashSystem 900 fixes are available at IBM’s Fix Central website. FlashSystem 840 is no longer supported.

Workarounds and Mitigations

None