IBMF191593346BC070943D7294CE8BE758C7A7C71B89FCBDED6E70D1288A833AAA9Security Bulletin: Buffer Overflow Vulnerability in IBM SDK Affects IBM Transformation Extender
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
63.7%
Summary
A vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Jan 2021 affects IBM Transformation Extender.
Vulnerability Details
CVEID:CVE-2020-27221
**DESCRIPTION:**Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/195353 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Transformation Extender | 9.0 |
| WebSphere Transformation Extender | 8.4.1 |
| IBM Transformation Extender | 10.0 |
| IBM Transformation Extender | 10.1 |
Remediation/Fixes
| Affected Product(s) | Version(s) | APAR | Download URL |
|---|---|---|---|
| IBM Transformation Extender | 9.0 | PH35846 | Link |
| WebSphere Transformation Extender | 8.4.1 | PH35846 | Link |
| IBM Transformation Extender | 10.0 | PH35846 | Link |
| IBM Transformation Extender | 10.1 | PH35846 | Link |
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm transformation extender | eq | 10.1 |
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.003 Low
EPSS
Percentile
63.7%