IBM Security Bulletin: Vulnerability in dependent component shipped in IBM Development Package for Apache Spark (CVE-2016-4970)
The developerWorks download for IBM Development Package for Apache Spark is not vulnerable in its default configuration. However, IBM Development Package for Apache Spark could be vulnerable to a Denial of Service attack if the ‘netty-tcnative’ component is added and configured onto the classpath during application development/deployment, because it provides the interface between Netty and an installed openSSL library.
CVE(s): CVE-2016-4970
Affected product(s) and affected version(s):
All IBM Development Package for Apache Spark, v1 releases
All IBM Development Package for Apache Spark, v2.0.0 releases
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2miK1Af
X-Force Database: http://ift.tt/2mPel1Z
The post IBM Security Bulletin: Vulnerability in dependent component shipped in IBM Development Package for Apache Spark (CVE-2016-4970) appeared first on IBM PSIRT Blog.
from IBM Product Security Incident Response Team http://ift.tt/2miq10U