IT47590: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2024-21147

APAR status

• Closed as program error.

Error description

• CVE ID: CVE-2024-21147
  Description
  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
  Oracle GraalVM Enterprise Edition product of Oracle Java SE
  (component: Hotspot).  Supported versions that are affected are
  Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3,
  22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle
  GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to
  exploit vulnerability allows unauthenticated attacker with
  network access via multiple protocols to compromise Oracle Java
  SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
  Successful attacks of this vulnerability can result in
  unauthorized creation, deletion or modification access to
  critical data or all Oracle Java SE, Oracle GraalVM for JDK,
  Oracle GraalVM Enterprise Edition accessible data as well as
  unauthorized access to critical data or complete access to all
  Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
  Enterprise Edition accessible data. Note: This vulnerability can
  be exploited by using APIs in the specified Component, e.g.,
  through a web service which supplies data to the APIs. This
  vulnerability also applies to Java deployments, typically in
  clients running sandboxed Java Web Start applications or
  sandboxed Java applets, that load and run untrusted code (e.g.,
  code that comes from the internet) and rely on the Java sandbox
  for security.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * CVE-2024-21147                                               *
  *                                                              *
  * See security bulletin for details:                           *
  * https://www.ibm.com/support/pages/node/7180453               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 1Q25   [ 54X-IBM-SI ]
  ( release target 1Q 2025 / January )
  
  To protect IBM Storage Insights against emerging
  security vulnerabilities, the service was updated to
  protected against vulnerabilities.
  
  An upgrade of your IBM Storage Insights Data Collector(s)
  will apply this fix.
  
  If you do not have automatic upgrade enabled, please
  upgrade your Data Collector(s) manually to apply the fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels