Security Bulletin: September 2021 :Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2021-2388
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to take control of the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/205815 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:CVE-2021-2369
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Library component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/205796 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID:CVE-2021-2432
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/205856 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

Updated JRE’s have been made available on Fix Central as Fix packs.
AIX: 8.0.6-CICSTG-AIXpSeries32-JRE-SR35
xLinux: 8.0.6-CICSTG-Linuxx8632-JRE-SR35
pLinux: 8.0.6-CICSTG-LinuxpSeries32-JRE-SR35
zLinux: 8.0.6-CICSTG-LinuxzSeries31-JRE-SR35
Windows:8.0.6-CICSTG-Windowsx8632-JRE-SR35

| Fix Central Link
CICS Transaction Gateway for Multiplatforms| 9.1.0.0
9.1.0.1
9.1.0.2
9.1.0.3|

Updated JRE’s have been made available on Fix Central as Fix packs.
AIX: 7.1.4-CICSTG-AIXpSeries32-JRE-SR90
xLinux: 7.1.4-CICSTG-Linuxx8632-JRE-SR90
pLinux: 7.1.4-CICSTG-LinuxpSeries32-JRE-SR90
zLinux: 7.1.4-CICSTG-LinuxzSeries31-JRE-SR90
Windows: 7.1.4-CICSTG-Windowsx8632-JRE-SR90

| Fix Central Link
CICS Transaction Gateway for Multiplatforms|

9.0.0.0
9.0.0.1
9.0.0.2
9.0.0.3
9.0.0.4

9.0.0.5
8.1.0.0
8.1.0.1
8.1.0.2
8.1.0.3
8.1.0.4
8.1.0.5
8.0.0.0
8.0.0.1
8.0.0.2
8.0.0.3
8.0.0.4
8.0.0.5
8.0.0.6

| Updated JRE’s have been made available on Fix Central as Fix packs.
Solaris: 7.0.10-CICSTG-SolarisSPARC32-JRE-SR90
AIX: 7.0.10-CICSTG-AIXpSeries32-JRE-SR90
xLinux: 7.0.10-CICSTG-Linuxx8632-JRE-SR90
pLinux: 7.0.10-CICSTG-LinuxpSeries32-JRE-SR90
zLinux: 7.0.10-CICSTG-LinuxzSeries31-JRE-SR90
Windows: 7.0.10-CICSTG-Windowsx8632-JRE-SR90| Fix Central Link

Workarounds and Mitigations

None