IBM Support

JR59330: SECURITY APAR - MULTIPLE VULNERABILITIES IN JACKSON LIBRARY AFFECT IBM BUSINESS PROCESS MANAGER

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

Direct links to fixes

workflow.18001.delta.repository
8.6.0.201803-WS-BPM-IFJR59330
8.6.0.201712-WS-BPM-IFJR59330
8.5.7.201706-WS-BPM-IFJR59330

 

APAR status

  • Closed as program error.

Error description

  • CVEID: CVE-2018-7489
DESCRIPTION: FasterXML jackson-databind could allow a remote
attacker to execute arbitrary code on the system, caused by a
deserialization flaw in the readValue method of the
ObjectMapper. By sending specially crafted JSON input, an
attacker could exploit this vulnerability to execute arbitrary
code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score:
See https://exchange.xforce.ibmcloud.com/vulnerabilities/139549 
for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2018-5968
DESCRIPTION: FasterXML jackson-databind could allow a remote
attacker to execute arbitrary code on the system, caused by
deserialization flaws. By using two different gadgets that
bypass a blacklist, an attacker could exploit this vulnerability
to execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score:
See https://exchange.xforce.ibmcloud.com/vulnerabilities/138088 
for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-17485
DESCRIPTION: Jackson-databind could allow a remote attacker to
execute arbitrary code on the system, caused by a flaw in the
default-typing feature. An attacker could exploit this
vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score:
See https://exchange.xforce.ibmcloud.com/vulnerabilities/137340 
for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Local fix

  • 



Problem summary


    

  • No additional information is available.

PRODUCTS AFFECTED
IBM Business Process Manager (BPM)
IBM BPM Advanced
IBM BPM Standard
IBM BPM Express

    



Problem conclusion


    

  • A fix will be available in IBM Business Automation Workflow that
updates the vulnerable library. After this fix is installed, you
can safely ignore vulnerability reports of security scanners for
CVEs mentioned in this APAR or you can mark them as false
positives.

    



Temporary fix


    

  • 



Comments


    

  • 



APAR Information




    

  • APAR number
    JR59330
    • 

  • Reported component name
    BPM
    • 

  • Reported component ID
    5737A5700
    • 

  • Reported release
    860
    • 

  • Status
    CLOSED  PER
    • 

  • PE
    NoPE
    • 

  • HIPER
    NoHIPER
    • 

  • Special Attention
    NoSpecatt / Xsystem
    • 

  • Submitted date
    2018-04-05
    • 

  • Closed date
    2018-05-15
    • 

  • Last modified date
    2018-05-15
    • 





    

  • APAR is sysrouted FROM one or more of the following:
    

    • 

  • APAR is sysrouted TO one or more of the following:
    

    • 



Fix information


    

  • Fixed component name
    BPM
    • 

  • Fixed component ID
    5737A5700
    • 



Applicable component levels


    








      
              
                            

              

              [{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFPJS","label":"IBM Business Process Manager"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.6.0.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
              

                          

          
 
        

      

    

      

        

          

            
Document Information


            

            


                        

            Modified date:
            

            14 September 2022
            

            
                      

        


        

        


      

    

  



    

  

  
    
            

          
Page Feedback