4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.104 Low
EPSS
Percentile
94.9%
IBM Sterilng B2B Integrator has addressed security vulnrabilities in Apache Santuario XML Security for Java.
CVEID:CVE-2013-4517
**DESCRIPTION:**Apache Santuario XML Security for Java is vulnerable to a denial of service, caused by an out of memory error when allowing Document Type Definitions (DTDs). A remote attacker could exploit this vulnerability via XML Signature transforms to cause a denial of service.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/89891 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID:CVE-2013-2172
**DESCRIPTION:**Apache Santuario XML Security for Java could allow a remote attacker to conduct spoofing attacks, caused by the failure to restrict canonicalization algorithms to be applied to the CanonicalizationMethod parameter. An attacker could exploit this vulnerability to spoof the XML signature.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/85323 for the current score.
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Sterling B2B Integrator | 6.0.0.0 - 6.0.3.6 |
IBM Sterling B2B Integrator | 6.1.0.0 - 6.1.0.4, 6โฆ1.1.0 |
Product | Version | APAR | Remediation & Fix |
---|---|---|---|
IBM Sterling B2B Integrator | 6.0.0.0 - 6.0.3.6 | IT38878 | Apply 6.0.3.7, 6.1.0.5, 6.1.1.1 or 6.1.2.0 |
IBM Sterling B2B Integrator | 6.1.0.0 - 6.1.0.4, 6.1.1.0 | IT38878 | Apply 6.1.0.5, 6.1.1.1 or 6.1.2.0 |
The version 6.0.3.7 , 6.1.0.5 and 6.1.1.1 are available on Fix Central. The IIM version of 6.1.2.0 is available in IBM Passport Advantage. The container version of 6.1.2.0 is available in IBM Entitled Registry with following tags.
cp.icr.io/cp/ibm-b2bi/b2bi:6.1.2.0 for IBM Sterling B2B Integrator
cp.icr.io/cp/ibm-sfg/sfg:6.1.2.0 for IBM Sterling File Gateway
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm sterling b2b integrator | eq | 6.0.0.0 | |
ibm sterling b2b integrator | eq | 6.1.2.0 |