JR63000: SECURITY APAR - MULTIPLE CVEs - VULNERABILITIES IN IBM JAVA SDK AFFECT IBM PROCESS DESIGNER

workflow.2102.delta.repository
8.6.20020002-WS-BPMPCPD-IFJR63000
8.6.20020001-WS-BPMPCPD-IFJR63000
8.6.10019003-WS-BPMPCPD-IFJR63000
8.6.0.201803-WS-BPMPCPD-IFJR63000
8.5.7.201706-WS-BPMPCPD-IFJR63000

APAR status

• Closed as program error.

Error description

• Multiple vulnerabilities in IBM SDK Java Technology Edition
  affect IBM Process Designer for IBM Business Automation
  Workflow:
  
  CVEID:   CVE-2020-14782
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the Libraries component could allow an unauthenticated
  attacker to cause no confidentiality impact, low integrity
  impact, and no availability impact.
  CVSS Base score: 3.7
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/190100 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
  
  CVEID:   CVE-2020-14781
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the JNDI component could allow an unauthenticated attacker to
  obtain sensitive information resulting in a low confidentiality
  impact using unknown attack vectors.
  CVSS Base score: 3.7
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/190099 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
  
  CVEID:   CVE-2020-14579
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the Libraries component could allow an unauthenticated
  attacker to cause a denial of service resulting in a low
  availability impact using unknown attack vectors.
  CVSS Base score: 3.7
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/185057 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
  
  CVEID:   CVE-2020-14578
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the Libraries component could allow an unauthenticated
  attacker to cause a denial of service resulting in a low
  availability impact using unknown attack vectors.
  CVSS Base score: 3.7
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/185056 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
  
  CVEID:   CVE-2020-14577
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the JSSE component could allow an unauthenticated attacker to
  obtain sensitive information resulting in a low confidentiality
  impact using unknown attack vectors.
  CVSS Base score: 3.7
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/185055 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
  

Local fix

Problem summary

• No additional information is available.
  
  PRODUCTS AFFECTED
  IBM Business Automation Workflow
  IBM Business Process Manager (BPM) Advanced
  IBM BPM Standard
  IBM BPM Express
  

Problem conclusion

• A fix that resolves CVE-2020-14782, CVE-2020-14781,
  CVE-2020-14579, CVE-2020-14578, CVE-2020-14577 in Process
  Designer is available for the latest fix pack for IBM BPM
  V8.5.7, IBM BPM V8.6, Business Automation Workflow 19.0.0.3,
  20.0.0.1, 20.0.0.2, and is planned for inclusion in a future
  release of Business Automation Workflow.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BUS AUTO WORKFL

• Fixed component ID

  5737H4100

Applicable component levels