Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-2369)

Summary

A flaw in the JAR validation implementation may, under certain limited circumstances, lead to a failure to detect signedJAR files that have been modified. The fix ensures that JARs that have been modified since they were signed are properly detected and treated asunsigned.

Vulnerability Details

CVEID:CVE-2021-2369
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Library component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/205796 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

Product

|

VRMF

|

iFix

|

Remediation

—|—|—|—

IBM Control Center

|

6.1.3.0

|

iFix12

|

Fix Central - 6.1.3.0

IBM Control Center

|

6.2.0.0

|

iFix10

or later

|

Fix Central - 6.2.0.0

Workarounds and Mitigations

None