Security Bulletin: Vulnerability in Spring Framework affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2018-15756)

Summary

Vulnerability in Spring Framework affects IBM Tivoli Application Dependency Discovery Manager.

Vulnerability Details

CVE-ID: CVE-2018-15756
Description: Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the ResourceHttpRequestHandler. By adding a range header with a high number of ranges, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base Score: 7.5
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/151641for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

TADDM 7.3.0.3 - 7.3.0.6

Remediation/Fixes

There are eFixes prepared on top of each of the Fixpacks which are affected by this vulnerability. If you have no eFixes installed on the given FixPack level, go ahead and download the eFix from the links given below. However, if you have eFixes installed on a given Fixpack level, please contact support for having a custom eFix built for your eFix level.

efix_IJ15471_FP6190313.zip

| 7.3.0.6 | None | Download eFix
efix_IJ15471_FP5180802.zip | 7.3.0.5 | None | Download eFix
efix_IJ15471_FP420171214.zip | 7.3.0.4 | None | Download eFix
efix_IJ15471_FP320160323.zip | 7.3.0.3 | None | Download eFix

Please get familiar with eFix readme in etc/<efix_name>_readme.txt

Workarounds and Mitigations

None