There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7 & 8 used by IBM CPLEX Optimization Studio. IBM CPLEX Optimization Studio has addressed the applicable CVEs.
CVEID:CVE-2022-21365
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217659 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID:CVE-2022-21360
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217654 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Product(s) | Version(s) |
---|---|
IBM ILOG CPLEX Optimization Studio (COS) | 20.1.0.1 |
IBM ILOG CPLEX Optimization Studio (COS) | 20.1 |
IBM ILOG CPLEX Optimization Studio (COS) | 12.10 |
IBM ILOG CPLEX Optimization Studio (COS) | 12.9 |
IBM ILOG CPLEX Optimization Studio (COS) | 12.8 |
IBM ILOG CPLEX Optimization Studio (COS) | 12.7.1 |
IBM ILOG CPLEX Optimization Studio (COS) | 12.7 |
The recommended solution is to download and install the appropriate version of IBM JRE as soon as practicable.
Before installing a newer version of IBM JRE, please ensure that you:
**IBM ILOG CPLEX Optimization Studio **
IBM Java Version 7 Service Refresh 11 Fix Pack 5 and subsequent releases
IBM Java Version 8 Service Refresh 7 Fix Pack 5 and subsequent releases
You must verify that applying this fix does not cause any compatibility issues.
Here are the detailed instructions for updating IBM JRE.
For Mac OS, HP-UX and Solaris, IBM recommends upgrading to a fixed, supported version/release/platform of the product.
None