Missing initialization of resource in OpenJ9 - CVE-2021-28167

Vulnerability identifier: #VU60084

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-28167

CWE-ID: CWE-909

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static methods or access static members without running the class initialization method. A remote attacker can send a specially crafted request to the application and observe uninitialized values.

OpenJ9
IBM Engineering Systems Design Rhapsody
IBM Tivoli Netcool Configuration Manager
InfoSphere Data Architect
Tivoli System Automation for Multiplatforms
Rational Business Developer (RBD)
IBM Java SDK
IBM Cloud Pak System
IBM VIOS
IBM AIX
IBM SPSS Collaboration and Deployment Services
CICS Transaction Gateway
IBM ILOG CPLEX Optimization Studio (COS)
IBM Operations Analytics Predictive Insights
IBM Tivoli System Automation Application Manager
IBM Cloud Application Performance Management (APM)
IBM Security Verify Access
IBM Cognos Analytics

Install updates from vendor's website.

OpenJ9 - update to 0.26.0
InfoSphere Data Architect - update to 9.2.1
IBM Operations Analytics Predictive Insights - update to 1.3.6.6
IBM Tivoli System Automation Application Manager - addressed in versions 4.1.0.2.0.13, 4.1.0.3.0.9, 4.1.0.4.0.6, 4.1.0.5.0.4
Tivoli System Automation for Multiplatforms - addressed in versions 4.1.0.4.0.17, 4.1.0.5.0.11, 4.1.0.6.0.6, 4.1.0.7.0.4
IBM Java SDK - update to 8.0.6.31
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.25
IBM Security Verify Access - update to 10.0.5.0
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2

• https://github.com/eclipse/openj9/issues/12016

• Missing initialization of resource in Eclipse Openj9
• Missing initialization of resource in IBM Java SDK
• Information disclosure in IBM Cloud Pak System
• Missing initialization of resource in IBM ILOG CPLEX Optimization Studio (COS)
• Missing initialization of resource in IBM Rational Business Developer
• IBM AIX update for Java SDK
• IBM VIOS update for Java SDK
• Missing initialization of resource in CICS Transaction Gateway Desktop Edition
• Missing initialization of resource in IBM Engineering Systems Design Rhapsody
• Missing initialization of resource in IBM SPSS Collaboration and Deployment Services
• Missing initialization of resource in IBM Tivoli Netcool Configuration Manager
• Missing initialization of resource in IBM Tivoli System Automation for Multiplatforms
• Missing initialization of resource in IBM Tivoli System Automation Application Manager
• Missing initialization of resource in IBM Security Verify Access
• Missing initialization of resource in IBM Cloud Application Performance Management
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM InfoSphere Data Architect