IT45337: MEDIUM SEVERITY VULNERABILITY IN IBM JRE (CVE-2023-22081, CVE-2023-5676)

APAR status

• Closed as program error.

Error description

• CVE-2023-22081 (CVSS 5.3)
  Description
  A flaw in the CertPath component
  allows an attacker to inflict a denial of service bypresenting a
  maliciously crafted certificate chain for validation, for
  example during TLS client authentication, which causes the
  server to hang for an extended period of time.
  
  CVE-2023-5676 (CVSS 4.1)
  Description
  A race condition in the OpenJ9 JVM may lead to an infinite busy
  hang if JVM shutdown is triggered (e.g. by sending aSIGTERM to
  the JVM process) before the JVM has finished starting up.
  

Local fix

Problem summary

• CVE-2023-22081 (CVSS 5.3)
  A flaw in the CertPath component
  allows an attacker to inflict a denial of service bypresenting a
  
  maliciously crafted certificate chain for validation, for
  example during TLS client authentication, which causes the
  server to hang for an extended period of time.
  
  CVE-2023-5676 (CVSS 4.1)
  A race condition in the OpenJ9 JVM may lead to an infinite busy
  hang if JVM shutdown is triggered (e.g. by sending aSIGTERM to
  the JVM process) before the JVM has finished starting up.
  

Problem conclusion

• Fix is available in  10.0.1.18, 10.5.0.10 and 10.5.4.0
  
  For a list of the latest fix packs available, please see:
  https://www.ibm.com/support/pages/node/83105
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels