Improper input validation in Java SE Embedded - CVE-2019-2933

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28701

Improper input validation in Java SE Embedded - CVE-2019-2933

Published: June 5, 2020


Vulnerability identifier: #VU28701
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-2933
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Libraries component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


Affected software

Java SE Embedded
Oracle Java SE
IBM Cloud Transformation Advisor
IBM CICS TX on Cloud
Dell EMC Data Protection Search
EMC Data Protection Advisor
Data Computing Appliance (DCA)
EMC ECS
IBM Tivoli Application Dependency Discovery Manager
openjdk8 (Alpine package)
Opensuse
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

How to mitigate CVE-2019-2933

Install updates from vendor's website.

Data Computing Appliance (DCA) - update to 3.5.5.0
IBM Tivoli Application Dependency Discovery Manager - update to 7.3.0.6
openjdk8 (Alpine package) - addressed in versions 8.232.09-r0, 8.242.08-r0
EMC ECS - update to 3.5.0.1
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
IBM CICS TX on Cloud - update to 10.1.0.0 SpecialFix 022020
Dell EMC Data Protection Search - update to 19.2
EMC Data Protection Advisor - update to 19.3

External References

Related Security Bulletins