JR64683: MULTIPLE VULNERABILITIES IN IBM ROBOTIC PROCESS AUTOMATION

21.0.1-IBMRPA-IF005

APAR status

• Closed as program error.

Error description

• CVEID:   CVE-2020-15522
  DESCRIPTION:   Bouncy Castle BC Java, BC C# .NET, BC-FJA, BC-FNA
  could allow a remote attacker to obtain sensitive information,
  caused by a timing issue within the EC math library. By utilize
  cryptographic attack techniques, an attacker could exploit this
  vulnerability to obtain the private key information, and use
  this information to launch further attacks against the affected
  system.
  CVSS Base score: 5.9
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/202188 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
  
  CVEID:   CVE-2021-43569
  DESCRIPTION:   Stark Bank Elixir .NET ECDSA library
  (ecdsa-dotnet) could allow a remote attacker to bypass security
  restrictions, caused by the failure to check that the signature
  is non-zero. By sending a specially-crafted request, an attacker
  could exploit this vulnerability to authenticate as any user
  within the Stark Bank platform, and bypass signature
  verification needed to perform operations on the platform.
  CVSS Base score: 9.8
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/213249 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
  
  CVEID:   CVE-2019-0820
  DESCRIPTION:   Microsoft .NET Framework and .NET Core is
  vulnerable to a denial of service, caused by improper processing
  of RegEx strings. By sending a specially-crafted request, an
  attacker could exploit this vulnerability to cause a denial of
  service condition in .NET application.
  CVSS Base score: 5.3
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/160363 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All                                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * No additional information is available.                      *
  *                                                              *
  * PRODUCTS AFFECTED                                            *
  * IBM Robotic Process Automation                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• A fix that ports fixes for these open source packages to IBM
  Robotic Process Automation is available.
  First fixed in IBM Robotic Process Automation 21.0.1.5 and
  21.0.2
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  RPA

• Fixed component ID

  5737N5100

Applicable component levels