JR61681: SECURITY APAR - CVE-2015-7450 AFFECTS IBM PROCESS DESIGNER

workflow.20001.delta.repository
8.5.7.201706-WS-BPMPCPD-IFJR61679
8.6.0.201803-WS-BPMPCPD-IFJR61679
8.6.10019001-WS-BPMPCPD-IFJR61679
8.6.10018001-WS-BPMPCPD-IFJR61679
8.6.10019002-WS-BPMPCPD-IFJR61679
8.6.10019003-WS-BPMPCPD-IFJR61679
8.0.1.3-WS-BPMPC-IFJR61681
8.5.7.201706-WS-BPMPCPD-IFJR61681
8.6.0.201803-WS-BPMPCPD-IFJR61681
8.6.10018001-WS-BPMPCPD-IFJR61681
8.6.10019001-WS-BPMPCPD-IFJR61681
8.6.10019002-WS-BPMPCPD-IFJR61681
8.6.10019003-WS-BPMPCPD-IFJR61681

APAR status

• Closed as program error.

Error description

• A vulnerability in Apache commons affects IBM Process Designer
  for IBM Business Automation Workflow.
  
  CVEID:   CVE-2015-7450
  DESCRIPTION:   Serialized-object interfaces in certain IBM
  analytics, business solutions, cognitive, IT infrastructure, and
  mobile and social products allow remote attackers to execute
  arbitrary commands via a crafted serialized Java object, related
  to the InvokerTransformer class in the Apache Commons
  Collections library.
  CVSS Base score: 9.8
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
  

Local fix

Problem summary

• No additional information is available.
  
  PRODUCTS AFFECTED
  IBM Business Automation Workflow
  IBM Business Process Manager (BPM) Advanced
  IBM BPM Standard
  IBM BPM Express
  

Problem conclusion

• A fix that resolves CVE-2015-7450 in Process Designer is
  available for the latest fix pack for IBM BPM V8.0.1.3, V8.5.7
  V8.6, Business Automation Workflow V18.0.0.1, V19.0.0.1,
  V19.0.0.2, V19.0.0.3, and it is planned for inclusion in future
  releases of Business Automation Workflow.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BUS AUTO WORKFL

• Fixed component ID

  5737H4100

Applicable component levels