SB2022081909 - Multiple vulnerabilities in IBM i
Published: August 19, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2021-2369)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error in JAR validation implementation. A remote attacker can modify the signed JAR file in a way it will be considered as signed.
2) Improper input validation (CVE-ID: CVE-2021-2432)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the JNDI component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
Remediation
Install update from vendor's website.
References
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java-runtime-for-ibm-i-are-affected-by-cve-2021-2369-and-cve-2021-2432/"
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java-runtime-for-ibm-i-are-affected-by-cve-2021-2369-and-cve-2021-2432/</a><br><a
- https://www.ibm.com/support/pages/node/6505311"
- https://www.ibm.com/support/pages/node/6505311</a><br><br><br></p>