IBMF520E1F8260819543C9BEDFE73D0F892ACBA8271386E8F13034AAD6F096A9D8DSecurity Bulletin: Vulnerability in IBM Java affects DB2 Recovery Expert for Linux, Unix and Windows
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
57.2%
Summary
IBM Java versions 8.0.7.0 - 8.0.7.11 are vulnerable to crypto attacks
Vulnerability Details
CVEID:CVE-2023-30441
**DESCRIPTION:**IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253188 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| DB2 Recovery Expert for LUW | 5.5.0.1 |
| DB2 Recovery Expert for LUW | 5.5.0.1 IF1 |
| DB2 Recovery Expert for LUW | 5.5.0.1 IF2 |
| DB2 Recovery Expert for LUW | 5.5.0.1 IF3 |
| DB2 Recovery Expert for LUW | 5.5.0.1 IF4 |
Remediation/Fixes
The product needs to be installed or upgraded to the latest available level using the latest 5.5.0.1 IF5 version available from Fix Central.
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| db2 recovery expert for linux, unix and windows | eq | 5.5.0.1 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
57.2%