Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2019-5419).

Summary

There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool.

Vulnerability Details

CVEID: CVE-2019-5419

DESCRIPTION: Ruby on Rails Action View module is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted accept headers, a remote attacker could exploit this vulnerability to cause a denial of service condition.

CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/158110&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

IBM License Metric Tool v9.x

Remediation/Fixes

Upgrade to version 9.2.16 or later using the following procedure:

• In IBM Endpoint Manager console, expand **IBM License Reporting (ILMT)**node under Sites node in the tree panel.
• Click Fixlets and Tasks node.Fixlets and Tasks panel will be displayed on the right.
• In the Fixlets and Tasks panel locate _Upgrade to the latest version of IBM License Metric Tool __9.x _fixlet and run it against the computer that hosts your server.

Workarounds and Mitigations

None