Security Bulletin
Summary
Multiple vulnerabilities in Jackson-databind were addressed by IBM InfoSphere Information Server.
Vulnerability Details
CVEID: CVE-2018-5968
DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by deserialization flaws. By using two different gadgets that bypass a blocklist, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/138088 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVEID: CVE-2017-17485
DESCRIPTION: Jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the default-typing feature. An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/137340 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2017-7525
DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by a deserialization flaw within the Jackson JSON library in the readValue method of the ObjectMapper. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/134639 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
The following products, running on all supported platforms, are affected:
IBM InfoSphere Information Analyzer: versions 11.5, and 11.7
IBM InfoSphere DataStage Amazon S3 Connector stage: versions 11.3, 11.5, and 11.7
IBM InfoSphere Information Server on Cloud: versions 11.5, and 11.7
Remediation/Fixes
|
Product |
VRMF | APAR | Remediation/First Fix |
| InfoSphere Information Analyzer, DataStage Amazon S3 Connector stage, Information Server on Cloud | 11.7 | JR59300 | --Apply IBM InfoSphere Information Server version 11.7.0.1 |
| InfoSphere Information Analyzer, DataStage Amazon S3 Connector stage, Information Server on Cloud | 11.5 | JR59300 |
--Apply IBM InfoSphere Information Server version 11.5.0.2 |
| InfoSphere DataStage Amazon S3 Connector stage | 11.3 | JR59300 |
--Apply IBM InfoSphere Information Server version 11.3.1.2 --Apply IBM InfoSphere DataStage Amazon S3 Connector stage Security Patch |
Contact Technical Support:
In the United States and Canada dial 1-800-IBM-SERV
View the support contacts for other countries outside of the United States.
Electronically open a Service Request with Information Server Technical Support.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
01 June 2018: Original Version Published
28 June 2018: Updated remediation information for releases 11.5 and 11.3
11 July 2018: Published fix for 11.3 and 11.5
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
PSIRT 113412
Was this topic helpful?
Document Information
Modified date:
11 July 2018
UID
swg22016016