Lucene search

IBM5E68991E1F6ED5D0C2EC92BCBB5F6ECBBC7D64A31D290F284E68A449C797E09D

HistoryOct 05, 2021 - 8:41 p.m.

Security Bulletin: Jackson-Dataformats Vulnerability Affects the B2B API of IBM Sterling B2B Integrator (CVE-2020-28491)

2021-10-0520:41:21

www.ibm.com

0.001 Low

EPSS

Percentile

44.5%

JSON

Summary

IBM Sterling B2B Integrator has addressed the security vulnerability

Vulnerability Details

CVEID:CVE-2020-28491
**DESCRIPTION:**FasterXML jackson-dataformats-binary is vulnerable to a denial of service, caused by an unchecked allocation of byte buffer flaw. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a java.lang.OutOfMemoryError exception resulting in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/197038 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	APAR(s)	Version(s)
IBM Sterling B2B Integrator	IT37677	5.2.0.0 - 5.2.6.5_4
IBM Sterling B2B Integrator	IT37677	6.0.0.0 - 6.0.0.6, 6.0.1.0 - 6.0.3.4
IBM Sterling B2B Integrator	IT37677	6.1.0.0 - 6.1.0.3

Remediation/Fixes

Product & Version	Remediation & Fix
5.2.0.0 - 5.2.6.5_4	Apply IBM Sterling B2B Integrator version 6.0.0.7, 6.0.3.5, 6.1.1.0 on Fix Central
6.0.0.0 - 6.0.0.6, 6.0.1.0 - 6.0.3.4	Apply IBM Sterling B2B Integrator version 6.0.0.7, 6.0.3.5, or 6.1.1.0 on Fix Central
6.1.0.0 - 6.1.0.3	Apply IBM Sterling B2B Integrator version 6.1.1.0 on Fix Central

Workarounds and Mitigations

None

CPENameOperatorVersion
sterling b2b integratoreq5.2.0.0
sterling b2b integratoreq6.1.1.0

CPE	Name	Operator	Version
	sterling b2b integrator	eq	5.2.0.0
	sterling b2b integrator	eq	6.1.1.0

0.001 Low

EPSS

Percentile

44.5%

JSON

Related for 5E68991E1F6ED5D0C2EC92BCBB5F6ECBBC7D64A31D290F284E68A449C797E09D