Security Bulletin: Security vulnerabilities in IBM Java Runtime affect Rational Publishing Engine

Summary

There are multiple vulnerabilities in IBM Java Runtime Environment, Versions 7 and 8 that are used by Rational Publishing Engine. These issues were disclosed as part of the IBM Java SDK updates in January 2019.

Vulnerability Details

CVEID: CVE-2019-2422 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/155741&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2019-2449 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE Deployment component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/155766&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2019-2426 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE Networking component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/155744&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Rational Publishing Engine 2.1.0
Rational Publishing Engine 2.1.1
Rational Publishing Engine 2.1.2
Rational Publishing Engine 6.0.5
Rational Publishing Engine 6.0.6

Rational Publishing Engine 6.0.6 .1

Remediation/Fixes

For Rational Publishing Engine 6.0.5, 6.0.6 and 6.0.6.1, upgrade the IBM Java Runtime environment used with Rational Publishing Engine to version 8.0.5.30, which can be downloaded from: Rational-RPE-JavaSE-JRE-8.0SR5FP30

For Rational Publishing Engine 2.1.0, 2.1.1 and 2.1.2 versions, upgrade the IBM Java Runtime environment used with Rational Publishing Engine to version 7.1.4.40, which can be downloaded from: Rational-RPE-JavaSE-JRE-7.1SR4FP40

Workarounds and Mitigations

None