Security Bulletin: IBM SmartCloud Orchestrator - Multiple security vulnerabilities exist in the IBM SDK, Java™ Technology Edition ( CVE-2014-4263, CVE-2014-4244)

Summary

Multiple security vulnerabilities exist in the IBM SDK, Java™ Technology Edition, which is shipped with IBM SmartCloud Orchestrator.

Vulnerability Details

CVEID: CVE-2014-4263**
DESCRIPTION:** An unspecified vulnerability in Oracle Java SE and JRockit that is related to the Security component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/94606&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVEID: CVE-2014-4244**
DESCRIPTION:** An unspecified vulnerability in Oracle Java SE and JRockit that is related to the Security component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/94605&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

Affected Products and Versions

IBM SmartCloud Orchestrator V2.2, V2.2 Fix Pack 1, and IBM SmartCloud Orchestrator V2.3, V2.3.0 Fix Pack 1 up to Interim Fix 5

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Upgrade to IBM SmartCloud Orchestrator 2.3.0 Fix Pack 1, Interim Fix 6.

Workarounds and Mitigations

None