IBM Support

Security Bulletin: A Security vulnerability has been identified in the IBM JDK bundled with Rational Build Forge (CVE-2017-10356)

Created by Anonymous (not verified) on
Published URL:
https://www.ibm.com/support/pages/node/711733
711733

Security Bulletin


Summary

IBM JDK bundled along with the Rational Build Forge has security vulnerability caused due to Java Run Time Environment. This issue were disclosed as part of the IBM Java SDK updates in October 2017.

Vulnerability Details


  • CVEID: CVE-2017-10356
    DESCRIPTION: The Java(TM) SE Runtime Environment in the Build Forge could allow unauthenticated attacker to log in to infrastructure and successfully execute Java SE to compromise confidential data. It allows a remote attacker to have unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Also, this vulnerability can be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications and Java applets, such as through a web service.
    CVSS Base Score: 3.0
    CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133785 for the current score.
    CVSS Environmental Score*: Undefined
    CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM Rational Build Forge from 8.0.0.7.

Remediation/Fixes

You must download the Fix pack specified in the following table and apply it.

Affected Supporting Product

Remediation/Fix

IBM Rational Build Forge 8.0.0.7

 Rational Build Forge 8.0.0.8 Download.

 

Workarounds and Mitigations

None.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None

Change History

* 12 JULY 2018: Original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Internal Use Only

None.

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSB2MV","label":"Rational Build Forge"},"Component":"Web Console","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"8.0.0.8","Edition":"Enterprise;Enterprise Plus;Express;Standard","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
20 April 2020

UID

swg22014222

Page Feedback