PI99443: IMPROPER OUTPUT NEUTRALIZATION FOR LOGS IN JSONSTORE CODE

APAR status

• Closed as program error.

Error description

• Product components impacted: MFP JSONStore SDK
  Mobile Devices Operating Systems impacted: Android
  Distribution: Fix Central
  Versions affected: 8.0
  The JSONStore SDK for Android and Cordova exhibits the CVE-117
  Improper Output Neutralization for Logs where the adapter
  response is not neutralized before output into Android Logcat
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Developers of Mobile application on Android using            *
  * MobileFirst JSONStore feature                                *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * During JSONStore Cloudant Downstream Sync ,response from     *
  * Cloudant DB is being logged without neutralization resulting *
  * in the CWE 117 vulnerability.This is seen only in Android.   *
  *                                                              *
  * For more details                                             *
  * https://cwe.mitre.org/data/definitions/117.html              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * -                                                            *
  ****************************************************************
  

Problem conclusion

• The vulnerability has been remediated by not logging the
  response.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MOBILE1ST PF EN

• Fixed component ID

  5725I4300

Applicable component levels