IBM Support

Security Bulletin: Vulnerabilities in FasterXML Jackson Databind and Apache Xerces affect IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments

Security Bulletin


Summary

IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments may be affected by the below FasterXML Jackson Databind and Apache Xerces vulnerabilities (CVEs).

Vulnerability Details

CVEID:   CVE-2020-25649
DESCRIPTION:   FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly. A remote attacker could exploit this vulnerability to launch XML external entity (XXE) attacks to have impact over data integrity.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/192648 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVEID:   CVE-2022-23437
DESCRIPTION:   Apache Xerces2 Java XML Parser is vulnerable to a denial of service, caused by an infinite loop in the XML parser. By persuading a victim to open a specially-crafted XML document payloads, a remote attacker could exploit this vulnerability to consume system resources for prolonged duration.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217982 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

IBM X-Force ID:   217968
DESCRIPTION:   FasterXML jackson-databind is vulnerable to a denial of service, caused by an error when using JDK serialization to serialize and deserialize JsonNode values. By sending a specially crafted request, an attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217968 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)Version(s)
IBM Spectrum Protect Backup-Archive Client8.1.0.0-8.1.15.1 (Macintosh and Windows)
8.1.7.0-8.1.15.1 (Linux web user interface only)
8.1.9.0-8.1.15.1 (AIX web user interface only)
IBM Spectrum Protect for Space Management8.1.7.0-8.1.15.1 (Linux)
8.1.9.0-8.1.15.1 (AIX)
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware8.1.0.0-8.1.15.1 (Linux and Windows)
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V8.1.0.0-8.1.15.1 (Windows)

 

Remediation/Fixes

IBM Spectrum Protect Backup-Archive Client Affected Versions
Fixing
Level
PlatformLink to Fix and Instructions
8.1.9.0-8.1.15.1 (AIX)
8.1.7.0-8.1.15.1 (Linux)
8.1.0.0-8.1.15.1 (Macintosh)
8.1.0.0-8.1.15.1 (Windows)
 8.1.15.2AIX*
Linux*
Macintosh
Windows
https://www.ibm.com/support/pages/node/6593819
    * The AIX and Linux platforms are only affected if using the web user interface.
 
 
IBM Spectrum Protect for
Space Management Affected Versions
Fixing
Level
PlatformLink to Fix and Instructions
8.1.9.0-8.1.15.1 (AIX)
8.1.7.0-8.1.15.1 (Linux)
 8.1.15.2AIX
Linux
ttps://www.ibm.com/support/pages/node/316077

 

IBM Spectrum Protect for
Virtual Environments:
Data Protection for VMware
Affected Versions
Fixing
Level
PlatformLink to Fix and Instructions
8.1.0.0-8.1.15.1 (Linux)
8.1.0.0-8.1.15.1 (Windows
 8.1.15.2Linux
Windows
https://www.ibm.com/support/pages/node/6568701

 

IBM Spectrum Protect for
Virtual Environments:
Data Protection for Hyper-V Affected Versions
Fixing
Level
PlatformLink to Fix and Instructions
8.1.0.0-8.1.15.1 (Windows) 8.1.15.2Windowshttps://www.ibm.com/support/pages/node/6568701
 

 

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

Change History

28 September 2022: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSERBH","label":"IBM Spectrum Protect for Space Management"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"}],"Version":"8.1","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSERB6","label":"IBM Spectrum Protect for Virtual Environments"},"Component":"","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"8.1","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSEQVQ","label":"IBM Spectrum Protect"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF017","label":"Mac OS"},{"code":"PF033","label":"Windows"}],"Version":"8.1","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}}]

Document Information

Modified date:
28 September 2022

UID

ibm16823731