There are vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Jul 2019 - Includes Oracle Jul 2019 CPU used by IBM Streams. IBM Streams has addressed the applicable CVEs.
CVE-2019-2769 (CVSS 5.3)DescriptionA flaw in the java.util component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product ApplicabilityThis issue is applicable if the JRE deserializes serialized object data from untrusted sources.
MitigationThe only solution is to upgrade the JRE.
CVE-2019-2762 (CVSS 5.3)DescriptionA flaw in the java.lang component allows an attacker to inflict a DoS via malicious serialized data which triggers an OutOfMemoryError.
The fix ensures that this type of malicious data is detected and handled gracefully.
Product ApplicabilityThis issue is applicable if the JRE deserializes serialized object data from untrusted sources.
MitigationThe only solution is to upgrade the JRE.
CVE-2019-2745 (CVSS 5.1)DescriptionEC keys can be extracted via side-channel attacks.
IBM Streams | 4.1.1.9 and earlier |
---|---|
IBM Streams | 4.2.1.7 and earlier |
IBM Streams | 4.3.1.0 and earlier |
NOTE: Fix Packs are available on IBM Fix Central.
To remediate/fix this issue, follow the instructions below:
Version 4.3.x: Apply _ 4.3.0 Fix Pack 1 (4.3.1.1) or higher_ .
Version 4.2.x: Apply 4.2.1 Fix Pack 4 (4.2.1.8) or higher .
Version 4.1.x: Apply 4.1.1 Fix Pack 6 (4.1.1.10) or higher
Versions 4.0.x, 3.2.x, 3.1.x, and 3.0.x: For versions earlier than 4.x.x, IBM recommends upgrading to a fixed, supported version/release/platform of the product. Customers who cannot upgrade and need to secure their installation should open a PMR with IBM Technical Support and request assistance securing their InfoSphere Streams system against the vulnerabilities identified in this Security Bulletin.
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm streams | eq | any |