CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
There are multiple vulnerabilities that affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition. Updates for CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition have been released to address these vulnerabilities.
CVEID:CVE-2024-3933
**DESCRIPTION:**Eclipse Openj9 could allow a local authenticated attacker to bypass security restrictions, caused by the failure to restrict access to a buffer with an incorrect length value when executing an arraycopy sequence while the Concurrent Scavenge Garbage Collection cycle is active and the source and destination memory regions for arraycopy overlap. By sending a specially crafted request, an attacker could exploit this vulnerability to gain read and write to addresses beyond the end of the array range.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/292491 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L)
CVEID:CVE-2024-21094
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/287959 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID:CVE-2024-21085
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low availability impacts.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/288000 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID:CVE-2024-21011
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low availability impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/288020 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID:CVE-2023-38264
**DESCRIPTION:**The IBM SDK, Java Technology Edition’s Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/260578 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2024-21012
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Networking component could allow a remote attacker to cause high integrity impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/288019 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM CICS Transaction Gateway for Multiplatforms | 9.1 |
IBM CICS Transaction Gateway for Multiplatforms | 9.2 |
IBM CICS Transaction Gateway for Multiplatforms | 9.3 |
CICS Transaction Gateway Desktop Edition | 9.1 |
CICS Transaction Gateway Desktop Edition | 9.2 |
CICS Transaction Gateway Desktop Edition | 9.3 |
IBM strongly recommends addressing the vulnerabilities now by upgrading IBM CICS Transaction Gateway for Multiplatforms and IBM Transaction Gateway Desktop Edition.
Product | Version | Remediation/Fix |
---|---|---|
IBM CICS Transaction Gateway for Multiplatforms and IBM CICS Transaction Gateway Desktop Edition |
9.1
|
PSIRT fixes for IBM CICS Transaction Gateway for Multiplatforms and IBM CICS Transaction Gateway Desktop Edition will be provided only for extended support customers with request through Salesforce case.
IBM CICS Transaction Gateway for Multiplatforms and IBM CICS Transaction Gateway Desktop Edition|
9.2
|
Download the upgrades from Fix Central:
AIX: Fix Central Link
Linux on POWER Big Endian: Fix Central Link
Linux on Intel: Fix Central Link
Linux on IBM Z: Fix Central Link
Windows: Fix Central Link
IBM CICS Transaction Gateway for Multiplatforms and IBM CICS Transaction Gateway Desktop Edition|
9.3
|
Download the upgrades from Fix Central:
AIX: Fix Central Link
Linux on POWER Big Endian: Fix Central Link
Linux on POWER Little Endian: Fix Central Link
Linux on Intel: Fix Central Link
Linux on IBM Z: Fix Central Link
Windows: Fix Central Link
Linux on Intel Container: Fix Central Link
Linux on IBM Z Container: Fix Central Link
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | cics_transaction_gateway | 9.1 | cpe:2.3:a:ibm:cics_transaction_gateway:9.1:*:*:*:*:*:*:* |
ibm | cics_transaction_gateway | 9.2 | cpe:2.3:a:ibm:cics_transaction_gateway:9.2:*:*:*:*:*:*:* |
ibm | cics_transaction_gateway | 9.3 | cpe:2.3:a:ibm:cics_transaction_gateway:9.3:*:*:*:*:*:*:* |
ibm | cics_transaction_gateway | 9.1 | cpe:2.3:a:ibm:cics_transaction_gateway:9.1:*:*:*:*:multiplatforms:*:* |
ibm | cics_transaction_gateway | 9.2 | cpe:2.3:a:ibm:cics_transaction_gateway:9.2:*:*:*:*:multiplatforms:*:* |
ibm | cics_transaction_gateway | 9.3 | cpe:2.3:a:ibm:cics_transaction_gateway:9.3:*:*:*:*:multiplatforms:*:* |
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High