Lucene search

IBM8D57D88D9FE644CB7B5D4811971ADB399359A3010F55AADD69BC85555E0232B2

HistoryOct 05, 2021 - 8:56 p.m.

Security Bulletin: Jackson Data Mapper Vulnerability Affects IBM Sterling B2B Integrator (CVE-2019-10172)

2021-10-0520:56:36

www.ibm.com

0.002 Low

EPSS

Percentile

60.0%

JSON

Summary

IBM Sterling B2B Integrator has addressed the security vulnerability.

Vulnerability Details

CVEID:CVE-2019-10172
**DESCRIPTION:**Jackson-mapper-asl could allow a remote attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data. By sending a specially-crafted XML data, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172436 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s)	APAR(s)	Version(s)
IBM Sterling B2B Integrator	IT37678	5.2.0.0 - 5.2.6.5_4
IBM Sterling B2B Integrator	IT37678	6.0.0.0 - 6.0.0.6, 6.0.1.0 - 6.0.3.4
IBM Sterling B2B Integrator	IT37678	6.1.0.0 - 6.1.0.3

Remediation/Fixes

Product & Version	Remediation & Fix
5.2.0.0 - 5.2.6.5_4	Apply IBM Sterling B2B Integrator version 6.0.0.7, 6.0.3.5, 6.1.1.0 on Fix Central
6.0.0.0 - 6.0.0.6, 6.0.1.0 - 6.0.3.4	Apply IBM Sterling B2B Integrator version 6.0.0.7, 6.0.3.5, or 6.1.1.0 on Fix Central
6.1.0.0 - 6.1.0.3	Apply IBM Sterling B2B Integrator version 6.1.1.0 on Fix Central

Workarounds and Mitigations

None

CPENameOperatorVersion
sterling b2b integratoreq5.2.0.0
sterling b2b integratoreq6.1.1.0

CPE	Name	Operator	Version
	sterling b2b integrator	eq	5.2.0.0
	sterling b2b integrator	eq	6.1.1.0

0.002 Low

EPSS

Percentile

60.0%

JSON

Related for 8D57D88D9FE644CB7B5D4811971ADB399359A3010F55AADD69BC85555E0232B2