Security Bulletin: Multiple vulnerabilities in IBM Java SDK (July 2024) affect IBM InfoSphere Information Server

Summary

There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in July 2024.

Vulnerability Details

CVEID:CVE-2024-21131
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low integrity impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/298464 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2024-27267
**DESCRIPTION:**The Object Request Broker (ORB) in IBM SDK, Java Technology Edition is vulnerable to remote denial of service, caused by a race condition in the management of ORB listener threads.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/284573 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Product|

VRMF

|

APAR

|

Remediation/First Fix

—|—|—|—

InfoSphere Information Server, Information Server on Cloud

|

11.7

|

DT394416

|

--Follow instructions in the README
--If not previously addressed, for AIX installations, see Technote for class not found errors related to ProviderExceptions, Failed to initialize IBMJCEPlus provider, and jgskit (Not found in java.library.path)

Workarounds and Mitigations

None