JR61957: SECURITY APAR - MULTIPLE CVEs - VULNERABILITIES IN JQUERY AFFECT DEPRECATED PORTAL

8.0.1.3-WS-BPM-IFJR62354
8.5.7.201706-WS-BPM-IFJR62354
8.6.0.201803-WS-BPM-IFJR62354
8.6.10019002-WS-BPM-IFJR62354
8.6.10019003-WS-BPM-IFJR62354
workflow.20001.delta.repository
8.6.10019003-WS-BPM-IFJR61957
8.6.10019002-WS-BPM-IFJR61957
8.6.0.201803-WS-BPM-IFJR61957
8.5.7.201706-WS-BPM-IFJR61957
8.0.1.3-WS-BPM-IFJR61957

APAR status

• Closed as program error.

Error description

• CVEID: CVE-2011-4969
  DESCRIPTION: Cross-site scripting (XSS) vulnerability in jQuery
  before 1.6.3, when using location.hash to select elements,
  allows remote attackers to inject arbitrary web script or HTML
  via a crafted tag.
  CVSS Base score: 4.3
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/82875 for
  the current score.
  CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
  
  CVEID: CVE-2012-6708
  DESCRIPTION: jQuery before 1.9.0 is vulnerable to Cross-site
  Scripting (XSS) attacks. The jQuery(strInput) function does not
  differentiate selectors from HTML in a reliable fashion. In
  vulnerable versions, jQuery determined whether the input was
  HTML by looking for the '<' character anywhere in the string,
  giving attackers more flexibility when attempting to construct a
  malicious payload. In fixed versions, jQuery only deems the
  input to be HTML if it explicitly starts with the '<' character,
  limiting exploitability only to attackers who can control the
  beginning of a string, which is far less common.
  CVSS Base score: 6.1
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/138055 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
  
  CVEID: CVE-2019-11358
  DESCRIPTION: jQuery before 3.4.0, as used in Drupal, Backdrop
  CMS, and other products, mishandles jQuery.extend(true, {}, ...)
  because of Object.prototype pollution. If an unsanitized source
  object contained an enumerable __proto__ property, it could
  extend the native Object.prototype.
  CVSS Base score: 6.1
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/159633 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
  
  
  PRODUCTS AFFECTED
  IBM Business Process Manager (BPM) Advanced
  IBM BPM Standard
  IBM BPM Express
  IBM BPM
  IBM Business Automation Workflow
  

Local fix

• N/A
  

Problem summary

• No additional information is available.
  

Problem conclusion

• A fix that updates the versions of JQuery used by the legacy
  Lombardi Portal is planned for inclusion in the latest fix packs
   of IBM BPM 8.0.1.3, IBM BPM 8.5 and 8.6, the latest two fix
  packs of Business Automation Workflow, and all future
  deliverables.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BUS AUTO WORKFL

• Fixed component ID

  5737H4100

Applicable component levels