Lucene search

K
ibmIBMF3AEC539272B0BF6E637DF53BB9DF359B7992CC9F335E021C40F205EAE88E18A
HistoryAug 23, 2024 - 2:42 p.m.

Security Bulletin: There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with TXSeries for Multiplatforms.

2024-08-2314:42:13
www.ibm.com
16
ibm sdk
java technology edition
txseries for multiplatforms
cve-2024-20952
cve-2024-20918
cve-2024-20921
cve-2024-20919
cve-2024-20926
cve-2024-20945
cve-2023-33850
vulnerabilities
update
security bulletin

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7

Confidence

High

EPSS

0.002

Percentile

55.2%

Summary

There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with TXSeries for Multiplatforms (CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850). An update to TXSeries for Multiplatforms has been released to address these vulnerabilities.

Vulnerability Details

**CVEID:**CVE-2024-20952 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow a remote attacker to cause high confidentiality impact and high integrity impact.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279685 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

**CVEID:**CVE-2024-20918 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality impact and high integrity impact.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279718 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

**CVEID:**CVE-2024-20921 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality impact.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279734 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

**CVEID:**CVE-2024-20919 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high integrity impact.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279785 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)

**CVEID:**CVE-2024-20926 DESCRIPTION: An unspecified vulnerability in Java SE related to the Scripting component could allow a remote attacker to cause high confidentiality impact.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279716 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

**CVEID:**CVE-2024-20945 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a local authenticated attacker to cause high confidentiality impact.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279775 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

**CVEID:**CVE-2023-33850 DESCRIPTION: IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 257132.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/257132 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM TXSeries for Multiplatforms 8.1
IBM TXSeries for Multiplatforms 8.2
IBM TXSeries for Multiplatforms 9.1

Remediation/Fixes

IBM strongly recommends addressing the vulnerabilities now by upgrading IBM TXSeries for Multiplatforms.

Product Version Platform Remediation/Fix
IBM TXSeries for Multiplatforms 8.1 Linux, AIX PSIRT fixes for IBM TXSeries for Multiplatforms 8.1 will be provided only for extended support customers with request through Salesforce case.
IBM TXSeries for Multiplatforms 8.2 Linux, AIX, Windows Download the update from Fix Central Link
IBM TXSeries for Multiplatforms 8.2 HP PSIRT fixes for TXSeries for Multiplatforms 8.2 will be provided only for extended support customers with request through Salesforce case
IBM TXSeries for Multiplatforms 9.1 Linux, AIX Download the update from Fix Central Link

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmtxseries_for_multiplatformsMatch8.1
OR
ibmtxseries_for_multiplatformsMatch8.2
OR
ibmtxseries_for_multiplatformsMatch9.1
VendorProductVersionCPE
ibmtxseries_for_multiplatforms8.1cpe:2.3:a:ibm:txseries_for_multiplatforms:8.1:*:*:*:*:*:*:*
ibmtxseries_for_multiplatforms8.2cpe:2.3:a:ibm:txseries_for_multiplatforms:8.2:*:*:*:*:*:*:*
ibmtxseries_for_multiplatforms9.1cpe:2.3:a:ibm:txseries_for_multiplatforms:9.1:*:*:*:*:*:*:*

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7

Confidence

High

EPSS

0.002

Percentile

55.2%

Related for F3AEC539272B0BF6E637DF53BB9DF359B7992CC9F335E021C40F205EAE88E18A