Lucene search

K
ibmIBMF588642A79176A46ED823D11A697FF3EABEE3414A45907898FD33D8346183616
HistoryMay 21, 2024 - 8:05 p.m.

Security Bulletin: IBM WebSphere Application Server could provide weaker than expected security (CVE-2023-50313)

2024-05-2120:05:05
www.ibm.com
14
ibm websphere
tls connections
cve-2023-50313
security vulnerability
fix pack
interim fix

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

15.5%

Summary

IBM WebSphere Application Server could provide weaker than expected security for outbound TLS connections.

Vulnerability Details

CVEID:CVE-2023-50313
**DESCRIPTION:**IBM WebSphere Application Server could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/274712 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM WebSphere Application Server 9.0
IBM WebSphere Application Server 8.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH61385.

For IBM WebSphere Application Server traditional:

For V9.0.0.0 through 9.0.5.19:
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PH61385
--OR–
· Apply Fix Pack 9.0.5.20 or later (targeted availability 2Q2024).

For V8.5.0.0 through 8.5.5.25:
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PH61385
--OR–
· Apply Fix Pack 8.5.5.26 or later (targeted availability 3Q2024).

Additional interim fixes may be available and linked off the interim fix download page.

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmwebsphere_application_serverMatch9.0
OR
ibmwebsphere_application_serverMatch8.5

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

15.5%

Related for F588642A79176A46ED823D11A697FF3EABEE3414A45907898FD33D8346183616