Improper input validation in Java SE Embedded - CVE-2019-2958

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28686

Improper input validation in Java SE Embedded - CVE-2019-2958

Published: June 5, 2020


Vulnerability identifier: #VU28686
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-2958
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.


Affected software

Java SE Embedded
Oracle Java SE
IBM Cloud Transformation Advisor
IBM CICS TX on Cloud
Dell EMC Data Protection Search
EMC Data Protection Advisor
Data Computing Appliance (DCA)
EMC ECS
Dell EMC NetWorker Runtime Environment (NRE)
IBM Tivoli Application Dependency Discovery Manager
openjdk8 (Alpine package)
Opensuse
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

How to mitigate CVE-2019-2958

Install updates from vendor's website.

Data Computing Appliance (DCA) - update to 3.5.5.0
IBM Tivoli Application Dependency Discovery Manager - update to 7.3.0.6
openjdk8 (Alpine package) - update to 8.232.09-r0
EMC ECS - update to 3.5.0.1
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC NetWorker Runtime Environment (NRE) - update to 8.0.3
IBM CICS TX on Cloud - update to 10.1.0.0 SpecialFix 022020
Dell EMC Data Protection Search - update to 19.2
EMC Data Protection Advisor - update to 19.3

External References

Related Security Bulletins