Lucene search

IBMFB34A3F09FFA8B097DAF51E2E7FC29B94DE45E57E1D7AC618EEFE756BC953514

HistoryDec 01, 2022 - 5:47 p.m.

Security Bulletin: A vulnerability in Open JDK affecting Rational Functional Tester

2022-12-0117:47:21

www.ibm.com

openj9

rational functional tester

security bypass

remote attackers

cve-2021-41041

jdk

openj9

rft 10.5

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

33.5%

JSON

Summary

A vulnerability in Open JDK Version 8, OpenJ9 used by Rational Functional Tester (RFT) versions 10.5. RFT has addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2021-41041
**DESCRIPTION:**Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by failing to throw the exception captured during bytecode verification when verification. By sending a specially-crafted request, an attacker could exploit this vulnerability to make unverified methods to be invoked using MethodHandles.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225398 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
Rational Function Tester (RFT)	RFT 10.5

Remediation/Fixes

Product	Version	APAR	Operating System	Remediation/ Fix
RFT	10.5.0	None	Windows 32 bit	<https://github.com/AdoptOpenJDK/semeru8-binaries/releases/download/jdk8u332-b09_openj9-0.32.0/ibm-semeru-open-jdk_x86-32_windows_8u332b09_openj9-0.32.0.zip>
Windows 64 bit	<https://github.com/AdoptOpenJDK/semeru8-binaries/releases/download/jdk8u332-b09_openj9-0.32.0/ibm-semeru-open-jdk_x64_windows_8u332b09_openj9-0.32.0.zip>
Linux	<https://github.com/AdoptOpenJDK/semeru8-binaries/releases/download/jdk8u332-b09_openj9-0.32.0/ibm-semeru-open-jdk_x64_linux_8u332b09_openj9-0.32.0.tar.gz>
Mac OS	<https://github.com/AdoptOpenJDK/semeru8-binaries/releases/download/jdk8u332-b09_openj9-0.32.0/ibm-semeru-open-jdk_x64_mac_8u332b09_openj9-0.32.0.tar.gz>

Download the JDK appropriate for your platform in order to manually replace the JDK.
Note: Please take backup of existing _${RFTinstallLocation}/_jdk folder.

Additional steps for Mac OS:

Run below commands

chmod -R +x ${RFTinstallLocation}/jdk/Contents/Home/bin
chmod -R +x ${RFTinstallLocation}/jdk/Contents/Home/jre/bin
chmod -R +x ${RFTinstallLocation}/jdk/Contents/Home/jre/lib/jspawnhelper
chmod -R +x ${RFTinstallLocation}/jdk/Contents/Home/jre/lib/*.dylib
rm -f ${RFTinstallLocation}/jdk/Contents/MacOS/libjli.dylib
ln -s ${RFTinstallLocation}/jdk/Contents/Home/jre/lib/jli/libjli.dylib ${RFTinstallLocation}/jdk/Contents/MacOS/libjli.dylib

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmrational_functional_testerMatch10.5.0

CPENameOperatorVersion
ibm rational functional testereq10.5.0

CPE	Name	Operator	Version
	ibm rational functional tester	eq	10.5.0

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

33.5%

JSON

Related for FB34A3F09FFA8B097DAF51E2E7FC29B94DE45E57E1D7AC618EEFE756BC953514