Source: TechWeb.com.cn
Release time: 2021-01-05
IBM WebSphere Application Server (WAS) is an application server product of IBM in the United States. This product is a platform for JavaEE and Web service applications, as well as the foundation of the IBM WebSphere software platform. After installing and deploying Rational Asset Manager in WAS, enterprises can effectively manage and reuse all types of assets in a distributed development environment.
On January 4, IBM released a security update that fixes some important vulnerabilities previously discovered in IBM WebSphere Application Server. The following are the details of the vulnerability:
Vulnerability details
CVE-2020-4329 Severity: Important
In the WebSphere Application Server (WAS) management console where Rational Asset Manager (RAM) is deployed, vulnerabilities have been observed, such as allowing remote attackers to access the class loader through class attributes, and authenticated attackers obtaining incorrect Sensitive information caused by parameter checking can be used to carry out spoofing attacks.
Affected products and versions
The above vulnerabilities affect the deployment of the following WAS versions of IBM Rational Asset Manager 7.5.1, 7.5.2.x, 7.5.3.x and 7.5.4.x:
IBM WebSphere Application Server versions 7.0, 8.0, 8.5 and 9.0.
Note: Rational Asset Manager 7.5.2 and later versions do not support embedded WebSphere Application Server.
solution
For traditional WebSphere Application Server and WebSphere Application Server Hypervisor Edition:
For V9.0.0.0 to 9.0.5.3: ·
Upgrade to the lowest fix pack level according to the interim fix requirements, and then apply the interim fix PH20847. -Or-·Apply Fix Pack 9.0.5.4 or higher (target availability 2Q2020).
For V8.5.0.0 to 8.5.5.17: ·
Upgrade to the lowest fix pack level according to the interim fix requirements, and then apply Interim Fix PH20847. -Or-·Apply fix pack 8.5.5.18 or higher (target availability is 3Q2020).
For V8.0.0.0 to 8.0.0.15: ·
Upgrade to 8.0.0.15, and then apply Interim Fix PH20847.
For V7.0.0.0 to 7.0.0.45: ·
Upgrade to 7.0.0.45, and then apply Interim Fix PH20847.