Security Bulletin: IBM UrbanCode Release is affected by CVE-2021-25122 and CVE-2021-25329

Summary

IBM UrbanCode Release version 6.2.2.7 - 6.2.5.2 are affected by CVE-2021-25122 and CVE-2021-25329

Vulnerability Details

CVEID:CVE-2021-25122
**DESCRIPTION:**Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a flaw when responding to new h2c connection requests. By sending a specially-crafted request, an attacker could exploit this vulnerability to see the request body information from one request to another, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/197517 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2021-25329
**DESCRIPTION:**Apache Tomcat could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw with a configuration edge case. By sending specially-crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/197519 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading to IBM UrbanCode Release version 6.2.5.3 or above.

Affected Supporting Product(s)

|

Remediation/Fix

—|—

IBM UrbanCode Release 6.2.2.7 – 6.2.5.2

|

Download IBM UrbanCode Release 6.2.5.5 – Includes Tomcat 8.5.69

Workarounds and Mitigations

None