Security Bulletin: IBM Sterling B2B Integrator vulnerable to denial of service due to XStream (CVE-2021-43859)

Summary

IBM Sterilng B2B Integrator has addressed a security vulnerabilitiy in XStream.

Vulnerability Details

CVEID:CVE-2021-43859
**DESCRIPTION:**XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote attacker could exploit this vulnerability to allocate 100% CPU time on the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219177 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

6.1.1.0 - 6.1.1.1

|

IT 40552

| Apply 6.1.0.5, 6.1.1.2 or 6.1.2.0

The version 6.0.3.7 , 6.1.0.5 and 6.1.1.2 are available on Fix Central. The IIM version of 6.1.2.0 is available in IBM Passport Advantage. The container version of 6.1.2.0 is available in IBM Entitled Registry with following tags.

cp.icr.io/cp/ibm-b2bi/b2bi:6.1.2.0 for IBM Sterling B2B Integrator
cp.icr.io/cp/ibm-sfg/sfg:6.1.2.0 for IBM Sterling File Gateway

Workarounds and Mitigations

None