CVE-2018-1656

Опубликовано: 20 авг. 2018

Источник: nvd

CVSS3: 7.4

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.

Ссылки

http://www.ibm.com/support/docview.wss?uid=ibm10719653
Vendor Advisory
http://www.securityfocus.com/bid/105118
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041765
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2568
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2569
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2575
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2576
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2712
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2713
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/144882
VDB Entry
Vendor Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch
Third Party Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10719653
Vendor Advisory
http://www.securityfocus.com/bid/105118
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041765
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2568
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2569
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2575
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2576
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2712
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2713
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:sdk:6.0:*:*:*:java_technology:*:*:*

cpe:2.3:a:ibm:sdk:7.0:*:*:*:java_technology:*:*:*

cpe:2.3:a:ibm:sdk:8.0:*:*:*:java_technology:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*

cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*

cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00527

Низкий

7.4 High

CVSS3

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2018-1656

CVSS3: 7.4

ubuntu

больше 7 лет назад

CVE-2018-1656

CVSS3: 6.5

redhat

больше 7 лет назад

GHSA-x34g-2xv6-mxf5

CVSS3: 6.5

github

больше 3 лет назад

BDU:2019-01753

CVSS3: 6.5

fstec

больше 7 лет назад

Уязвимость набора средств разработки IBM SDK, существующая из-за неверного ограничения имени пути к каталогу с ограниченным доступом, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

SUSE-SU-2018:2649-2

suse-cvrf

больше 7 лет назад

Security update for java-1_7_1-ibm

EPSS

Процентиль: 66%

0.00527

Низкий

7.4 High

CVSS3

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-22