CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS
Percentile
49.9%
IBM Java is used by IBM Sterling Connect:Direct for UNIX on AIX and Linux platforms in product configuration, management, and data transmission. IBM Sterling Connect:Direct for UNIX on AIX and Linux platforms is impacted by unspecified vulnerabilities in IBM Java. IBM Sterling Connect:Direct for UNIX on AIX and Linuxplatforms has upgraded IBM Java to version 8.0.8.5 to address the issues.
CVEID:CVE-2023-21930
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the JSSE component could allow an unauthenticated attacker to cause high confidentiality impact and high integrity impact.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253115 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID:CVE-2023-21967
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the Hotspot component could allow a remote attacker to cause high confidentiality impact.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253166 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID:CVE-2023-21954
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the JSSE component could allow a remote attacker to cause high availability impact.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253156 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2023-21939
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the Swing component could allow a remote attacker to cause integrity impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253168 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID:CVE-2023-21968
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE and GraalVM Enterprise Edition related to the Libraries component could allow an unauthenticated attacker to cause low integrity impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253083 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID:CVE-2023-21937
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the Networking component could allow a remote attacker to cause integrity impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253167 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID:CVE-2023-21938
**DESCRIPTION:**An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the Libraries component could allow a remote attacker to cause integrity impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253155 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID:CVE-2023-2597
**DESCRIPTION:**Eclipse Openj9 is vulnerable to a buffer overflow, caused by improper bounds checking by the getCachedUTFString() function. By using specially crafted input, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/255906 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM Sterling Connect:Direct for UNIX | 6.0.0.0 - 6.0.0.2.iFix151 |
IBM Sterling Connect:Direct for UNIX | 6.1.0.0 - 6.1.0.4.iFix087 |
IBM Sterling Connect:Direct for UNIX | 6.2.0.0 - 6.2.0.6.iFix023 |
IBM Sterling Connect:Direct for UNIX | 6.3.0.0 - 6.0.0.0.iFix009 |
IBM strongly recommends addressing the vulnerability now by upgrading
Product | Version | Remediation/Fix/Instructions |
---|---|---|
IBM Sterling Connect:Direct for UNIX | 6.3.0 | Apply 6.3.0.0.iFix011, available on Fix Central. |
IBM Sterling Connect:Direct for UNIX | 6.2.0 | Apply 6.2.0.6.iFix024, available on Fix Central. |
IBM Sterling Connect:Direct for UNIX | 6.1.0 | Apply 6.1.0.4.iFix088, available on Fix Central. |
IBM Sterling Connect:Direct for UNIX | 6.0.0 | Apply 6.0.0.2.iFix152, available on Fix Central. |
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | sterling_connect\ | direct_for_unix | cpe:2.3:a:ibm:sterling_connect\:direct_for_unix:6.3.0:*:*:*:*:*:*:* |
ibm | sterling_connect\ | direct_for_unix | cpe:2.3:a:ibm:sterling_connect\:direct_for_unix:6.2.0:*:*:*:*:*:*:* |
ibm | sterling_connect\ | direct_for_unix | cpe:2.3:a:ibm:sterling_connect\:direct_for_unix:6.1.0:*:*:*:*:*:*:* |
ibm | sterling_connect\ | direct_for_unix | cpe:2.3:a:ibm:sterling_connect\:direct_for_unix:6.0.0:*:*:*:*:*:*:* |
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS
Percentile
49.9%