Security Bulletin: WebSphere Message Broker is affected by a Open Source Apache Tomcat Vulnerability (CVE-2017-5664 )

Summary

WebSphere Message Broker has addressed the following vulnerabilities

Vulnerability Details

CVEID**:** CVE-2017-5664 **
DESCRIPTION:** Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the improper handling of specific HTTP request methods for static error pages by the Default Servlet error page mechanism. By sending a specially crafted GET request, an attacker could exploit this vulnerability to bypass HTTP method restrictions and cause the deletion or replacement of the target error page.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/126962 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)

Affected Products and Versions

WebSphere Message Broker V8.0.0.0 - V8.0.0.8

Remediation/Fixes

Product

| VRMF|APAR|Remediation/Fix
—|—|—|—
WebSphere Message Broker| V8.0.0.9| APAR IT21580 | For a fix for APAR IT21580, please contact IBM support.

Websphere Message Broker V8 is no longer in full support; IBM recommends upgrading to a fixed, supported version/release/platform of the product. If you are an extended support customer and require a fix, this is available only for the latest fixpack (8.0.0.9) .To obtain the fix contact IBM support.