JR61747: SECURITY APAR - MULTIPLE CVEs - VULNERABILITIES IN JQUERY AFFECT THE SWAGGER UI

workflow.20001.delta.repository
8.6.10019003-WS-BPM-IFJR62222
8.6.10019002-WS-BPM-IFJR62222
8.6.0.201803-WS-BPM-IFJR61747
8.5.7.201706-WS-BPM-IFJR61747

APAR status

• Closed as program error.

Error description

• CVEID: CVE-2012-6708
  DESCRIPTION: jQuery before 1.9.0 is vulnerable to Cross-site
  Scripting (XSS) attacks. The jQuery(strInput) function does not
  differentiate selectors from HTML in a reliable fashion. In
  vulnerable versions, jQuery determined whether the input was
  HTML by looking for the '<' character anywhere in the string,
  giving attackers more flexibility when attempting to construct a
  malicious payload. In fixed versions, jQuery only deems the
  input to be HTML if it explicitly starts with the '<' character,
  limiting exploitability only to attackers who can control the
  beginning of a string, which is far less common.
  CVSS Base score: 6.1
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/138055 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
  
  CVEID: CVE-2015-9251
  DESCRIPTION: jQuery before 3.0.0 is vulnerable to Cross-site
  Scripting (XSS) attacks when a cross-domain Ajax request is
  performed without the dataType option, causing text/javascript
  responses to be executed.
  CVSS Base score: 6.1
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/138029 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
  
  CVEID: CVE-2019-11358
  DESCRIPTION: jQuery before 3.4.0, as used in Drupal, Backdrop
  CMS, and other products, mishandles jQuery.extend(true, {}, ...)
  because of Object.prototype pollution. If an unsanitized source
  object contained an enumerable __proto__ property, it could
  extend the native Object.prototype.
  CVSS Base score: 6.1
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/159633 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
  
  PRODUCTS AFFECTED
  IBM Business Process Manager (BPM) Advanced
  IBM BPM Standard
  IBM BPM Express
  IBM BPM
  IBM Business Automation Workflow
  

Local fix

Problem summary

• No additional information is available.
  
  PRODUCTS AFFECTED
  IBM Business Process Manager (BPM) Advanced
  IBM BPM Standard
  IBM BPM Express
  IBM BPM
  IBM Business Automation Workflow
  

Problem conclusion

• A fix that resolves these CVEs in Business Automation Workflow
  is ready for you to download and install.
  
  Note: If you installed an interim fix on a previous version, do
  not install interim fix JR61747 while upgrading. Otherwise,
  profileUpgrade may not run. For example, if you installed
  interim fix JR61747 on IBM BPM 8.5.7 2017.06 and decided to
  upgrade to IBM BPM 8.6 2018.03, make sure you install IBM BPM
  8.6 2018.03 interim fix JR61747 after upgrading to 2018.03 is
  complete.
  
  For IBM Business Automation Workflow 19.0.0.2 and 19.0.0.3,
  install interim fix JR62222.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BUS AUTO WORKFL

• Fixed component ID

  5737H4100

Applicable component levels