Direct links to fixes
8.0.1.3-WS-BPM-IFJR62354
8.5.7.201706-WS-BPM-IFJR62354
8.6.0.201803-WS-BPM-IFJR62354
8.6.10019002-WS-BPM-IFJR62354
8.6.10019003-WS-BPM-IFJR62354
workflow.20001.delta.repository
8.6.10019003-WS-BPM-IFJR61957
8.6.10019002-WS-BPM-IFJR61957
8.6.0.201803-WS-BPM-IFJR61957
8.5.7.201706-WS-BPM-IFJR61957
8.0.1.3-WS-BPM-IFJR61957
APAR status
Closed as program error.
Error description
CVEID: CVE-2011-4969 DESCRIPTION: Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag. CVSS Base score: 4.3 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/82875 for the current score. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) CVEID: CVE-2012-6708 DESCRIPTION: jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. CVSS Base score: 6.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/138055 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) CVEID: CVE-2019-11358 DESCRIPTION: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. CVSS Base score: 6.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159633 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) PRODUCTS AFFECTED IBM Business Process Manager (BPM) Advanced IBM BPM Standard IBM BPM Express IBM BPM IBM Business Automation Workflow
Local fix
N/A
Problem summary
No additional information is available.
Problem conclusion
A fix that updates the versions of JQuery used by the legacy Lombardi Portal is planned for inclusion in the latest fix packs of IBM BPM 8.0.1.3, IBM BPM 8.5 and 8.6, the latest two fix packs of Business Automation Workflow, and all future deliverables.
Temporary fix
Comments
APAR Information
APAR number
JR61957
Reported component name
BUS AUTO WORKFL
Reported component ID
5737H4100
Reported release
I00
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2020-02-06
Closed date
2020-04-01
Last modified date
2020-04-01
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
BUS AUTO WORKFL
Fixed component ID
5737H4100
Applicable component levels
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SS8JB4","label":"IBM Business Automation Workflow"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"18.0.0.0","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
03 September 2020