IBMF557307CD0267F0BB6B6DC26809AC99A331B0B830E5ED518DFD0226F748BC0D0Security Bulletin: Vulnerability in IBM® Runtime Environment Java™ Version 8 affect Cloud Pak System. [CVE-2023-30441]
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
57.2%
Summary
Vulnerability in IBM® Runtime Environment Java™ Version 8 used by Cloud Pak System. Cloud Pak System has addressed vulnerability. [CVE-2023-30441]
Vulnerability Details
CVEID:CVE-2023-30441
**DESCRIPTION:**IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253188 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Cloud Pak System | 2.3.3.4 - 2.3.3.5 (Intel) |
| IBM Cloud Pak System Software Suite | 2.3.3.4 - 2.3.3.5 |
Remediation/Fixes
Cloud Pak System upgraded Java to IBM SDK Java 8.0.7.15 along with Cloud Pak System v2.3.3.6.
For IBM Cloud Pak System V2.3.3.4, V2.3.3.5
upgrade to IBM Cloud Pak System V2.3.3.6 at Fix Central
Information on upgrading at : <http://www.ibm.com/support/docview.wss?uid=ibm10887959>
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm cloud pak system software | eq | 2.3.3 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
57.2%