Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flaws
IBM and Red Hat say Lightwell fixed more than 400 previously unknown Java library flaws without naming them.
IBM and Red Hat said their Lightwell program found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries. Lightwell rewrites patches so they apply to older library versions still running in production, and Clearinghouse is now generally available for customers to request priority review of specific dependencies. The companies did not name the libraries or publish CVE identifiers, severity ratings, or a disclosure timeline. Upstream fixes go back through responsible disclosure, so organizations outside the program must wait for public releases.
52