There are vulnerabilities in deserialization of openid connect cookie used by IBM Streams. IBM Streams has addressed the applicable CVEs.
CVEID: CVE-2018-1851 DESCRIPTION: IBM WebSphere Application Server OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code.
CVSS Base Score: 7.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/150999> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected InfoSphere Streams | Affected Versions |
---|---|
InfoSphere Streams | 4.0.1.6 and earlier |
InfoSphere Streams | 3.2.1.6 and earlier |
IBM Streams | 4.1.1.7 and earlier |
IBM Streams | 4.2.1.5 and earlier |
IBM Streams | 4.3.0.0 |
NOTE: Fix Packs are available on IBM Fix Central.
To remediate/fix this issue, follow the instructions below:
Version 4.3.x: Apply 4.3.0 Fix Pack 1 (4.3.0.1) or higher .
Version 4.2.x: Apply 4.2.1 Fix Pack 4 (4.2.1.6) or higher .
Version 4.1.x: Apply 4.1.1 Fix Pack 6 (4.1.1.8) or higher .
Version 4.0.x: Apply 4.0.1 Fix Pack 6 (4.0.1.6) or higher .
Versions 3.2.x, 3.1.x, and 3.0.x: For versions earlier than 4.x.x, IBM recommends upgrading to a fixed, supported version/release/platform of the product. Customers who cannot upgrade and need to secure their installation should open a PMR with IBM Technical Support and request assistance securing their InfoSphere Streams system against the vulnerabilities identified in this Security Bulletin.
None