IT48848: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2025-50106 CVE-2025-30749 CVE-2025-30754 CVE-2025-21587 CVE-2025-30698

APAR status

• Closed as program error.

Error description

• CVEID:   CVE-2025-50106
  DESCRIPTION:   Vulnerability in the Oracle Java SE, Oracle
  GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
  Oracle Java SE (component: 2D). Supported versions that are
  affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27,
  17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7
  and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14.
  Difficult to exploit vulnerability allows unauthenticated
  attacker with network access via multiple protocols to
  compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle
  GraalVM Enterprise Edition. Successful attacks of this
  vulnerability can result in takeover of Oracle Java SE, Oracle
  GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This
  vulnerability can be exploited by using APIs in the specified
  Component, e.g., through a web service which supplies data to
  the APIs. This vulnerability also applies to Java deployments,
  typically in clients running sandboxed Java Web Start
  applications or sandboxed Java applets, that load and run
  untrusted code (e.g., code that comes from the internet) and
  rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1
  (Confidentiality, Integrity and Availability impacts).
  
  CVEID:   CVE-2025-30749
  DESCRIPTION:   Vulnerability in the Oracle Java SE, Oracle
  GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
  Oracle Java SE (component: 2D). Supported versions that are
  affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27,
  17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7
  and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14.
  Difficult to exploit vulnerability allows unauthenticated
  attacker with network access via multiple protocols to
  compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle
  GraalVM Enterprise Edition. Successful attacks of this
  vulnerability can result in takeover of Oracle Java SE, Oracle
  GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This
  vulnerability applies to Java deployments, typically in clients
  running sandboxed Java Web Start applications or sandboxed Java
  applets, that load and run untrusted code (e.g., code that comes
  from the internet) and rely on the Java sandbox for security.
  This vulnerability does not apply to Java deployments, typically
  in servers, that load and run only trusted code (e.g., code
  installed by an administrator). CVSS 3.1 Base Score 8.1
  (Confidentiality, Integrity and Availability impacts).
  
  CVEID:   CVE-2025-30754
  DESCRIPTION:   Vulnerability in the Oracle Java SE, Oracle
  GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
  Oracle Java SE (component: JSSE). Supported versions that are
  affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27,
  17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7
  and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14.
  Difficult to exploit vulnerability allows unauthenticated
  attacker with network access via TLS to compromise Oracle Java
  SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
  Successful attacks of this vulnerability can result in
  unauthorized update, insert or delete access to some of Oracle
  Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
  Edition accessible data as well as unauthorized read access to a
  subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
  Enterprise Edition accessible data. Note: This vulnerability
  applies to Java deployments, typically in clients running
  sandboxed Java Web Start applications or sandboxed Java applets,
  that load and run untrusted code (e.g., code that comes from the
  internet) and rely on the Java sandbox for security. This
  vulnerability does not apply to Java deployments, typically in
  servers, that load and run only trusted code (e.g., code
  installed by an administrator). CVSS 3.1 Base Score 4.8
  (Confidentiality and Integrity impacts).
  
  CVEID:   CVE-2025-21587
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the Server: DDL component could allow a remote attacker to
  cause high confidentiality and high integrity impact.
  
  CVEID:   CVE-2025-30698
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the 2D component could allow a remote attacker to cause low
  confidentiality, low integrity and low availability impact.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * CVE-2025-50106 CVE-2025-30749 CVE-2025-30754 CVE-2025-21587  *
  * CVE-2025-30698                                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is targeted for the following release:
  
  IBM Storage Insights 4Q25   [ 54X-IBM-SI ]
  ( release target 4Q 2025 / December )
  
  The target dates for future releases do not represent a formal
  commitment by IBM. The dates are subject to change without
  notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels