JR64796: SECURITY BULLETIN: IBM RPA BEFORE 21.0.2 AND 21.0.1.2 COULD ALLOW A QUEUE TO BE DELETED BY A REGISTERED USER

APAR status

• Closed as program error.

Error description

• IBM Robotic Process Automation before 21.0.2 and 21.0.1.2 could
  allow a queue to be deleted by a registered user. This could
  cause a disruption on any RPA scripts dependent on queues.
  
   CVEID:   CVE-2022-22319
  DESCRIPTION:   IBM Robotic Process Automation could allow a
  register user on the system to physically delete a queue that
  could cause disruption for any scripts dependent on the queue.
  CVSS Base score: 4.6
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/218366 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All                                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * No additional information is available.                      *
  *                                                              *
  * PRODUCTS AFFECTED                                            *
  * IBM Robotic Process Automation                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• First fixed in:
  21.0.1 IF002
  21.0.2 GA
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  RPA

• Fixed component ID

  5737N5100

Applicable component levels