IBM Support

JR54748: SECURITY APAR - CVE-2015-7450 - VULNERABILITY IN APACHE COMMONS COLLECTIONS AFFECTS IBM BPM DOCUMENT STORE

Direct links to fixes

8.5.0.2-WS-BPM-IFJR54748
8.5.0.1-WS-BPM-IFJR54748
8.5.6.1-WS-BPM-IFJR54748
8.5.5.0-WS-BPM-IFJR54748
Version 8.5 Refresh Pack 7 for the IBM Business Process Manager products

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • An Apache Commons Collections vulnerability for handling Java
object deserialization affected the IBM Business Process Manager
document store.

Local fix

  • 



Problem summary


    

  • No additional information is available.

    



Problem conclusion


    

  • A fix is available for IBM BPM V8.5.0.1, IBM BPM V8.5.0.2, IBM
BPM V8.5.5.0, and IBM BPM V8.5.6.0 CF1 that updates the
vulnerable open source library in the document store
application.

On Fix Central (http://www.ibm.com/support/fixcentral), search
for JR54748:

1. Select IBM Business Process Manager with your edition from
  the product selector, the installed version to the fix pack
  level, and your platform, and then click Continue.

2. Select APAR or SPR, enter JR54748, and click Continue.

When you download fix packages, ensure that you also download
the readme file for each fix. Review each readme file for
additional installation instructions and information about the
fix.

A fix will be included in an IBM BPM V8.5.6.0 cumulative fix. To
determine whether the cumulative fix is available and download
it if it is, complete the following steps on Fix Central:

1. Select IBM Business Process Manager with your edition from
  the product selector, the installed version to the fix pack
  level, and your platform, and then click Continue.

2. Select Text, enter "cumulative fix", and click Continue.

    



Temporary fix


    

  • 



Comments


    

  • 



APAR Information




    

  • APAR number
    JR54748
    • 

  • Reported component name
    BPM STANDARD
    • 

  • Reported component ID
    5725C9500
    • 

  • Reported release
    850
    • 

  • Status
    CLOSED  PER
    • 

  • PE
    NoPE
    • 

  • HIPER
    NoHIPER
    • 

  • Special Attention
    NoSpecatt
    • 

  • Submitted date
    2015-11-17
    • 

  • Closed date
    2015-12-01
    • 

  • Last modified date
    2015-12-01
    • 





    

  • APAR is sysrouted FROM one or more of the following:
    

    • 

  • APAR is sysrouted TO one or more of the following:
    

    • 



Fix information


    

  • Fixed component name
    BPM STANDARD
    • 

  • Fixed component ID
    5725C9500
    • 



Applicable component levels


    

  • R850  PSY
       UP
    • 

  • R855  PSY
       UP
    • 

  • R856  PSY
       UP
    • 








      
              
                            

              

              [{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSFTDH","label":"IBM Business Process Manager Standard"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.5","Line of Business":{"code":"LOB45","label":"Automation"}}]
              

                          

          
 
        

      

    

      

        

          

            
Document Information


            

            


                        

            Modified date:
            

            13 October 2021
            

            
                      

        


        

        


      

    

  



    

  

  
    
            

          
Page Feedback