IBM Security Bulletin: Multiple vulnerabilities in cURL affect IBM Workload Scheduler

Oct 23, 2017 10:00 am EDT

Categorized: Medium Severity

Share this post:

cURL vulnerabilities were disclosed by the cURL Project. OpenSSL is used by IBM Workload Manager. IBM Workload Manager has addressed the applicable CVEs

CVE(s): CVE-2016-8616, CVE-2016-8621, CVE-2016-8624

Affected product(s) and affected version(s):

TWS uses cURL libraries only for secure communication.
These security exposures do not apply to the embedded WebSphere Application Server but only to the TWS dynamic agent. These are the affected releases

Tivoli Workload Scheduler Distributed 8.6.0 FP04 and earlier
Tivoli Workload Scheduler Distributed 9.1.0 FP02 and earlier
Tivoli Workload Scheduler Distributed 9.2.0 FP02 and earlier
IBM Workload Scheduler Distributed 9.3.0 FP02 and earlier
IBM Workload Scheduler Distributed 9.4.0 GA

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2gxIzpr
X-Force Database: http://ift.tt/2qtZDjS
X-Force Database: http://ift.tt/2ps7LTj
X-Force Database: http://ift.tt/2nvOe1t

from IBM Product Security Incident Response Team http://ift.tt/2gxfr1o