Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMDCE2F602EA1DB6B4E4F6D3A7B931347ABB1D8910B7288BA8403D0F714F79BCF6
HistoryDec 03, 2020 - 5:20 a.m.

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Watson Explorer and Watson Explorer Content Analytics Studio (CVE-2020-14579, CVE-2020-14578, CVE-2020-14577, CVE-2020-14621)

2020-12-0305:20:43
www.ibm.com
13

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 and Version 7 used by Watson Explorer and Watson Explorer Content Analytics Studio. Watson Explorer and Watson Explorer Content Analytics Studio have addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2020-14579
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185057 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2020-14578
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185056 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2020-14577
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185055 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2020-14621
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JAXP component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185099 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s) Applicable Vulnerabilities
IBM Watson Explorer Deep Analytics Edition Foundational Components 12.0.0.0, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.4

CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621

IBM Watson Explorer Deep Analytics Edition Analytical Components| 12.0.0.0, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.4| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer Deep Analytics Edition oneWEX| 12.0.0.0, 12.0.0.1, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.4| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer
Foundational Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 -
11.0.2.8| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer Foundational Components| 10.0.0.0 - 10.0.0.9| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer Foundational Components Annotation Administration Console|

12.0.0.0, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.4

| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer Foundational Components Annotation Administration Console| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 - 11.0.2.8| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer Foundational Components Annotation Administration Console| 10.0.0.0 - 10.0.0.6| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer Analytical Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 -
11.0.2.8| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer Analytical Components| 10.0.0.0 - 10.0.0.2| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
CVE-2020-14621
IBM Watson Explorer Content Analytics Studio| 12.0.0, 12.0.1, 12.0.2, 12.0.3| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577
IBM Watson Explorer Content Analytics Studio|

11.0.0.0 - 11.0.0.3,
11.0.1, 11.0.2.0 - 11.0.2.2

| CVE-2020-14579
CVE-2020-14578
CVE-2020-14577

Remediation/Fixes

Affected Produc****t Affected Versions Required IBM Java Runtime How to acquire and apply the fix
IBM Watson Explorer DAE
Foundational Components 12.0.0.0, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.4 JVM 8 SR6 FP15 or later

  1. If you have not already installed, install V12.0.3.4 (see the Fix Pack download document). If you upgrade to Version 12.0.3.4 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  2. Download the IBM Java Runtime, Version 8 package for your operating system from Fix Central: interim fix 12.0.3.4-WS-WatsonExplorer-DAEFoundational-<OS>-8SR6FP16 or later (for example, 12.0.3.4-WS-WatsonExplorer-DAEFoundational-Linux-8SR6FP16).

  3. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer DAE
    Analytical Components| 12.0.0.0, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.4| JVM 8 SR6 FP15 or later|

  4. If you have not already installed, install V12.0.3.4 (see the Fix Pack download document). If you upgrade to Version 12.0.3.4 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  5. Download the IBM Java Runtime, Version 8 package for your operating system from Fix Central: interim fix 12.0.3.4-WS-WatsonExplorer-DAEAnalytical-<OS>-8SR6FP16 or later (for example, 12.0.3.4-WS-WatsonExplorer-DAEAnalytical-Linux-8SR6FP16).

  6. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer DAE
    oneWEX| 12.0.0.0, 12.0.0.1, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.4| JVM 8 SR6 FP15 or later|

  7. If you have not already installed, install V12.0.3.4 (see the Fix Pack download document). If you upgrade to Version 12.0.3.4 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  8. Download the IBM Java Runtime, Version 8 package for your operating system from Fix Central: interim fix 12.0.3.4-WS-WatsonExplorer-DAEoneWEX-8SR6FP16.

  9. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer
    Foundational Components| 11.0.0.0 - 11.0.0.3,
    11.0.1,
    11.0.2.0 -
    11.0.2.8| JVM 8 SR6 FP15 or later|

  10. If you have not already installed, install V11.0.2 Fix Pack 8 (see the Fix Pack download document). If you upgrade to Version 11.0.2.8 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  11. Download the IBM Java Runtime, Version 8 package for your edition (Enterprise or Advanced) and operating system from Fix Central: interim fix 11.0.2.8-WS-WatsonExplorer-<Edition>Foundational-<OS>-8SR6FP16 or later (for example, 11.0.2.8-WS-WatsonExplorer-EEFoundational-Linux-8SR6FP16).

  12. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer Foundational Components| 10.0.0.0 - 10.0.0.9| JVM 8 SR6 FP15 or later|

  13. If you have not already installed, install V10.0 Fix Pack 9 (see the Fix Pack download document). If you upgrade to Version 10.0.0.9 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  14. Download the IBM Java Runtime, Version 8 package for your edition (Enterprise or Advanced) and operating system from Fix Central: interim fix 10.0.0.9-WS-WatsonExplorer-<Edition>Foundational-<OS>-8SR6FP16 or later (for example, 10.0.0.9-WS-WatsonExplorer-EEFoundational-Linux-8SR6FP16).

  15. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer Foundational Components Annotation Administration Console|

12.0.0.0, 12.0.1, 12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.4

| JVM 8 SR6 FP15 or later|

  1. If you have not already installed, install V12.0.3.4 (see the Fix Pack download document). If you upgrade to Version 12.0.3.4 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  2. Download the IBM Java Runtime, Version 8 package for your operating system from Fix Central: interim fix 12.0.3.4-WS-WatsonExplorer-DAEFoundationalAAC-<OS>-8SR6FP16 or later (for example, 12.0.3.4-WS-WatsonExplorer-DAEFoundationalAAC-Linux-8SR6FP16).

  3. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer Foundational Components Annotation Administration Console| 11.0.0.0 - 11.0.0.3,
    11.0.1,
    11.0.2.0 -
    11.0.2.8| JVM 8 SR6 FP15 or later|

  4. If you have not already installed, install V11.0.2 Fix Pack 8 (see the Fix Pack download document). If you upgrade to Version 11.0.2.8 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  5. Download the IBM Java Runtime, Version 8 package for your edition (Enterprise or Advanced) and operating system from Fix Central: interim fix 11.0.2.8-WS-WatsonExplorer-<Edition>FoundationalAAC-<OS>-8SR6FP16 or later (for example, 11.0.2.8-WS-WatsonExplorer-EEFoundationalAAC-Linux-8SR6FP16).

  6. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer Foundational Components Annotation Administration Console| 10.0.0.0 - 10.0.0.6| JVM 8 SR6 FP15 or later|

  7. If you have not already installed, install V10.0 Fix Pack 6 (see the Fix Pack download document). If you upgrade to Version 10.0.0.6 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  8. If you have not upgraded IBM Java Runtime from Version 7 to Version 8, download the 32-bit (or 31-bit, if you use Linux on System z) and 64-bit packages of IBM Java Runtime, Version 8 package for your edition (Enterprise or Advanced) and operating system from Fix Central: interim fix 10.0.0.6-WS-WatsonExplorer-<Edition>FoundationalAAC-<OS>-8SR6FP1****0(for example, 10.0.0.6-WS-WatsonExplorer-AEFoundationalAAC-Linux-8SR6FP10, which includes 64-bit version of IBM Java Runtime). Follow the steps in Updating WebSphere Liberty and IBM Java Runtime used in IBM Watson Explorer Analytical Components to upgrade IBM Java Runtime from Version 7 to Version 8.

  9. Download the 32-bit and 64-bit packages of IBM Java Runtime, Version 8 package for your edition (Enterprise or Advanced) and operating system from Fix Central: interim fix 10.0.0.6-WS-WatsonExplorer-<Edition>FoundationalAAC-<OS>-8SR6FP16or later (for example, 10.0.0.6-WS-WatsonExplorer-AEFoundationalAAC-Linux-8SR6FP16, which includes 64-bit version of IBM Java Runtime).

  10. To apply the fix, follow the steps in Updating IBM Java Runtime.

IBM Watson Explorer Analytical Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 -
11.0.2.8| JVM 8 SR6 FP15 or later|

  1. If you have not already installed, install V11.0.2 Fix Pack 8 (see the Fix Pack download document). If you upgrade to Version 11.0.2.8 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  2. Download the IBM Java Runtime, Version 8 package for your edition (Enterprise or Advanced) and operating system from Fix Central: interim fix 11.0.2.8-WS-WatsonExplorer-<Edition>Analytical-<OS>-8SR6FP16 or later (for example, 11.0.2.8-WS-WatsonExplorer-EEAnalytical-Linux-8SR6FP16).

  3. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer Analytical Components| 10.0.0.0 - 10.0.0.2| JVM 8 SR6 FP15 or later|

  4. If you have not already installed, install V10.0 Fix Pack 2 (see the Fix Pack download document). If you upgrade to Version 10.0.0.2 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  5. If you have not upgraded IBM Java Runtime from Version 7 to Version 8, download the 32-bit (or 31-bit, if you use Linux on System z) and 64-bit packages of IBM Java Runtime, Version 8 package for your edition (Enterprise or Advanced) and operating system from Fix Central: interim fix 10.0.0.2-WS-WatsonExplorer-<Edition>Analytical-<OS>[32|31]-8SR6FP10(for example, 10.0.0.2-WS-WatsonExplorer-AEAnalytical-Linux-8SR6FP10, which includes 64-bit version of IBM Java Runtime). Follow the steps in Updating WebSphere Liberty and IBM Java Runtime used in IBM Watson Explorer Analytical Components to upgrade IBM Java Runtime from Version 7 to Version 8.

  6. Download the 32-bit (or 31-bit, if you use Linux on System z) and 64-bit packages of IBM Java Runtime, Version 8 package for your edition (Enterprise or Advanced) and operating system from Fix Central: interim fix 10.0.0.2-WS-WatsonExplorer-<Edition>Analytical-<OS>[32|31]-8SR6FP16or later (for example, 10.0.0.2-WS-WatsonExplorer-AEAnalytical-Linux-8SR6FP16, which includes 64-bit version of IBM Java Runtime).

  7. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer Content Analytics Studio| 12.0.0, 12.0.1, 12.0.2, 12.0.3| JVM 8 SR6 FP15 or later|

  8. If you have not already installed, install Version 12.0.3. For information about Version 12.0.3, and links to the software and release notes, see the download document. If you upgrade to Version 12.0.3 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.

  9. Download the IBM Java Runtime, Version 8 package and operating system from Fix Central: interim fix 12.0.3.0-WS-WatsonExplorer-DAEAnalytical-CAStudio-8SR6FP16 or later (for example, 12.0.3.0-WS-WatsonExplorer-AEAnalytical-CAStudio-8SR6FP16, which includes 64-bit version of IBM Java Runtime).

  10. To apply the fix, follow the steps in Updating IBM Java Runtime.
    IBM Watson Explorer Content Analytics Studio|

11.0.0.0 - 11.0.0.3,
11.0.1, 11.0.2.0 - 11.0.2.2

| JVM 8 SR6 FP15 or later|

  1. If you have not already installed, install Version 11.0.2.2. If you upgrade to Version 11.0.2.2 after you update IBM Java Runtime, your changes are lost and you must repeat the steps.
    * For information about Version 11.0.2, and links to the software and release notes, see the download document.
    * For information about upgrading, see the upgrade procedures.For information about Version 11.0.2.2, see the download document.
  2. Download the IBM Java Runtime, Version 8 package and operating system from Fix Central: interim fix 11.0.2.2-WS-WatsonExplorer-AEAnalytical-CAStudio-8SR6FP16 or later (for example, 11.0.2.2-WS-WatsonExplorer-AEAnalytical-CAStudio-8SR6FP16, which includes 64-bit version of IBM Java Runtime).
  3. To apply the fix, follow the steps in Updating IBM Java Runtime.

Workarounds and Mitigations

None

Related

ibm 111
nessus 37
oraclelinux 3
redhat 9
amazon 2
centos 2
mageia 1
fedora 2
osv 2
debian 2
ubuntu 1
aix 1
f5 3
kaspersky 1
gentoo 1
veracode 2
redhatcve 3
ubuntucve 3
prion 4
alpinelinux 3
debiancve 3
cve 3
ibm
ibm
Security Bulletin: IBM API Connect V5 is impacted by vulnerabilities in Java (CVE-2020-14621, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579)
2021-01-04 22:25:40
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11.
2020-10-08 10:37:07
Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Virtualization Engine TS7700 - July 2020
2020-12-01 21:41:44
nessus
nessus
CentOS 8 : java-1.8.0-openjdk (CESA-2020:2972)
2021-02-01 00:00:00
Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20200716)
2020-07-22 00:00:00
SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2020:14484-1)
2021-06-10 00:00:00
oraclelinux
oraclelinux
java-1.8.0-openjdk security update
2020-07-18 00:00:00
java-1.8.0-openjdk security update
2020-07-16 00:00:00
java-1.8.0-openjdk security update
2020-07-17 00:00:00
redhat
redhat
(RHSA-2020:3101) Important: java-1.8.0-openjdk security update
2020-07-22 12:20:56
(RHSA-2020:3100) Important: java-1.8.0-openjdk security update
2020-07-22 12:20:39
(RHSA-2020:2972) Important: java-1.8.0-openjdk security update
2020-07-16 08:25:58
amazon
amazon
Important: java-1.8.0-openjdk
2020-09-15 18:00:00
Important: java-1.8.0-openjdk
2020-09-14 20:58:00
centos
centos
java security update
2020-08-07 12:59:34
java security update
2020-08-07 12:30:19
mageia
mageia
Updated java-1.8.0-openjdk packages fix security vulnerability
2020-08-01 02:25:42
fedora
fedora
[SECURITY] Fedora 31 Update: java-1.8.0-openjdk-1.8.0.262.b10-1.fc31
2020-07-28 15:03:32
[SECURITY] Fedora 32 Update: java-1.8.0-openjdk-1.8.0.262.b10-1.fc32
2020-07-23 01:07:12
osv
osv
openjdk-8 - security update
2020-08-13 00:00:00
openjdk-11 - security update
2020-07-26 00:00:00
debian
debian
[SECURITY] [DLA 2325-1] openjdk-8 security update
2020-08-13 10:07:24
[SECURITY] [DSA 4734-1] openjdk-11 security update
2020-07-26 19:58:03
ubuntu
ubuntu
OpenJDK 8 vulnerabilities
2020-08-05 00:00:00
aix
aix
Multiple vulnerabilities in IBM Java SDK affect AIX
2020-11-03 15:29:58
f5
f5
K51591999 : Multiple Java vulnerabilities CVE-2020-14562, CVE-2020-14573, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579, CVE-2020-14581, CVE-2020-14593
2022-09-05 00:00:00
K55053009 : Oracle Java SE JAXP vulnerability CVE-2020-14621
2020-10-26 00:00:00
K85742355 : Java SE vulnerability CVE-2020-14577
2020-10-22 00:00:00
kaspersky
kaspersky
KLA11867 Multiple vulnerabilities in Oracle Java SE
2020-07-14 00:00:00
gentoo
gentoo
OpenJDK: Multiple vulnerabilities
2020-08-30 00:00:00
veracode
veracode
Denial Of Service (DoS)
2020-07-17 05:37:47
Sandbox Restrictions Bypass
2020-07-17 05:50:39
redhatcve
redhatcve
CVE-2020-14621
2020-07-15 09:39:04
CVE-2020-14579
2020-07-15 09:38:56
CVE-2020-14578
2020-07-15 09:39:03
ubuntucve
ubuntucve
CVE-2020-14579
2020-07-14 00:00:00
CVE-2020-14577
2020-07-14 00:00:00
CVE-2020-14578
2020-07-14 00:00:00
prion
prion
Design/Logic Flaw
2020-07-15 18:15:00
Design/Logic Flaw
2020-07-15 18:15:00
Code injection
2020-07-15 18:15:00
alpinelinux
alpinelinux
CVE-2020-14578
2020-07-15 18:15:00
CVE-2020-14579
2020-07-15 18:15:00
CVE-2020-14621
2020-07-15 18:15:00
debiancve
debiancve
CVE-2020-14621
2020-07-15 18:15:00
CVE-2020-14578
2020-07-15 18:15:00
CVE-2020-14579
2020-07-15 18:15:00
cve
cve
CVE-2020-14579
2020-07-15 18:15:00
CVE-2020-14578
2020-07-15 18:15:00
CVE-2020-14621
2020-07-15 18:15:00

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON
Related for DCE2F602EA1DB6B4E4F6D3A7B931347ABB1D8910B7288BA8403D0F714F79BCF6
ibm111nessus37oraclelinux3redhat9amazon2centos2mageia1fedora2osv2debian2ubuntu1aix1f53kaspersky1gentoo1veracode2redhatcve3ubuntucve3prion4alpinelinux3debiancve3cve3