Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary

Ramda(CVE-2021-42581) is vulnerable to remote attackers to execute arbitrary code on the system, caused by a prototype pollution in functions. An attacker could exploit this vulnerability to execute arbitrary code on the system. Node-forge(CVE-2022-24773, 217313, CVE-2022-24771, CVE-2020-7720, CVE-2022-0122, CVE-2022-24772) is vulnerable to remote attackers to bypass security restrictions, caused by improper signature verification. Axios(CVE-2022-1214) is vulnerable to remote atackers to obtain sensitive information. Nginx(CVE-2021-46461, CVE-2021-46462, CVE-2021-46463) is vulnerable to remote atackers and denial service attacks caused by weaknesses in njs. Async(CVE-2021-43138) allow a remote attacker to execute arbitrary code on the system, caused by prototype pollution in the mapValues() method. Paramiko(CVE-2022-24302) is vulnerable to local attackers to obtain sensitive information caused by a race condition in the write_private_key_file function. Python(CVE-2022-26488) allow a local authenticated attacker to gain elevated privileges on the systemcaused by an issue when the search path is inadequately secured. Psutil(CVE-2019-18874) is vulnerable to a denial of service, caused by a double free, this vulnerability to cause the application to crash. dns-packet(CVE-2021-23386) could allow a remote authenticated attacker to obtain sensitive information, caused by an issue when creating buffers and does not always fill them before forming network packets. express-jwt(CVE-2020-15084) could allow a remote attacker to bypass security restrictions, caused by improper enforcement of algorithms. oslo.utils(CVE-2022-0718) could allow a remote authenticated attacker to obtain sensitive information, caused by improper character masking by the mask_passwords functions. Python-RSA(CVE-2020-13757, CVE-2020-25658) is vulnerable to denial of service attacks and remote attackers, caused by a flaw during the decryption of ciphertext and the Bleichenbacher timing attack. Minimist(CVE-2020-7598, CVE-2021-44906) could provide weaker than expected security, caused by a prototype pollution flaw, and could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in setKey() function in the index.js script. Reportlab(CVE-2020-28463) is vulnerable to server-side request forgery, caused by improper input validation. Ansible(CVE-2021-20180, CVE-2021-3533, CVE-2020-14330) could allow a local authenticated attacker to obtain sensitive information, caused by disclosure of information in the console log when using the bitbucket_pipeline_variable, by an improper output neutralization for logs and by a flaw in race condition in ansible’s async code. NumPy(CVE-2021-34141, CVE-2021-41496) is vulnerable to a denial of service, caused by incomplete string comparison in the numpy.core component and by a buffer overflow in the array_from_pyobj function of fortranobject.c. Ljharb qs(CVE-2017-1000048) is vulnerable to a denial of service, caused by sending a specially-crafted request and by insufficient sanitization of property in the gs.parse function. Node.js debug module(CVE-2017-16137) is vulnerable to regular expression denial of service when passing untrusted user input.

Vulnerability Details

CVEID:CVE-2021-46461
**DESCRIPTION:**njs, as used in NGINX, could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read in njs_vmcode_typeof in /src/njs_vmcode.c. An attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219731 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2021-42581
**DESCRIPTION:**Ramda could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in the mapObjIndexed function. By supplying a specially-crafted object using the proto argument, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/226072 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2017-16137
**DESCRIPTION:**Node.js debug module is vulnerable to regular expression denial of service when passing untrusted user input. A remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/135678 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2021-46462
**DESCRIPTION:**njs, as used in NGINX, is vulnerable to a denial of service, caused by a flaw in njs_object_set_prototype in /src/njs_object.c. A remote attacker could exploit this vulnerability to cause a segmentation fault.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219730 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2021-44906
**DESCRIPTION:**Node.js Minimist module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in setKey() function in the index.js script. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222195 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2021-20180
**DESCRIPTION:**Ansible could allow a local authenticated attacker to obtain sensitive information, caused by disclosure of information in the console log when using the bitbucket_pipeline_variable. An attacker could exploit this vulnerability to steal bitbucket_pipeline credentials.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222527 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-43138
**DESCRIPTION:**Async could allow a remote attacker to execute arbitrary code on the system, caused by prototype pollution in the mapValues() method. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/223605 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:CVE-2021-34141
**DESCRIPTION:**NumPy is vulnerable to a denial of service, caused by incomplete string comparison in the numpy.core component. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to fail the APIs.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215944 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2021-41496
**DESCRIPTION:**NumPy is vulnerable to a denial of service, caused by a buffer overflow in the array_from_pyobj function of fortranobject.c. By constantly creating sort arrays, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215807 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2017-1000048
**DESCRIPTION:**Ljharb qs is vulnerable to a denial of service. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/130305 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2022-24773
**DESCRIPTION:**Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking DigestInfo for a proper ASN.1 structure. By using a specially-crafted signature with invalid structures but a valid digest, an attacker could exploit this vulnerability to bypass signature verification.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222174 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2022-24771
**DESCRIPTION:**Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking the digestAlgorithm structure. By using a specially-crafted structure to steal padding bytes and uses unchecked portion of the PKCS#1 encoded message, an attacker could exploit this vulnerability to forge a signature when a low public exponent is being used.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222172 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVEID:CVE-2020-7720
**DESCRIPTION:**Node.js node-forge module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the util.setPath function. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187620 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2022-0122
**DESCRIPTION:**Node.js node-forge could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability to redirect a victim to arbitrary Web sites.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/216833 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)

CVEID:CVE-2022-24772
**DESCRIPTION:**Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. By sending a specially-crafted request with garbage data, an attacker could exploit this vulnerability to forge a signature when a low public exponent is being used.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222173 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVEID:CVE-2021-3533
**DESCRIPTION:**Ansible could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in race condition in ansible’s async code. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203873 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)

CVEID:CVE-2020-14330
**DESCRIPTION:**Ansible Engine could allow a local authenticated attacker to obtain sensitive information, caused by an improper output neutralization for logs flaw when using uri. An attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/188183 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-44907
**DESCRIPTION:**Qs is vulnerable to a denial of service, caused by insufficient sanitization of property in the gs.parse function. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222194 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2020-28463
**DESCRIPTION:**Python is vulnerable to server-side request forgery, caused by improper input validation. By using specially-crafted img tags, an attacker could exploit this vulnerability to conduct SSRF attack.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/197036 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2020-7598
**DESCRIPTION:**minimist could provide weaker than expected security, caused by a prototype pollution flaw. By sending a specially crafted request, a remote attacker could exploit this vulnerability to add or modify properties of Object.prototype.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/177780 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2020-13757
**DESCRIPTION:**Python-RSA is vulnerable to a denial of service, caused by a flaw during the decryption of ciphertext. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/182813 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2020-25658
**DESCRIPTION:**Python-RSA could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timing attack. By sending a specially-crafted request using the RSA decryption API, an attacker could exploit this vulnerability to obtain parts of the cipher text encrypted with RSA, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/191710 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2022-0718
**DESCRIPTION:**OpenStack oslo.utils could allow a remote authenticated attacker to obtain sensitive information, caused by improper character masking by the mask_passwords functions. By gaining access to the debug output, an attacker could exploit this vulnerability to obtain partial passwords, and use this information to launch further attacks against the affected system.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222683 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-23386
**DESCRIPTION:**Node.js dns-packet module could allow a remote authenticated attacker to obtain sensitive information, caused by an issue when creating buffers with allocUnsafe and does not always fill them before forming network packets. By querying specially-crafted domain names, an attacker could exploit this vulnerability to obtain internal application memory information, and use this information to launch further attacks against the affected system.
CVSS Base score: 6.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202417 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L)

CVEID:CVE-2021-46463
**DESCRIPTION:**njs, as used in NGINX, could allow a remote attacker to execute arbitrary code on the system, caused by type confusion in njs_promise_perform_then(). An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219729 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2019-18874
**DESCRIPTION:**psutil is vulnerable to a denial of service, caused by a double free. By using specially-crafted data, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/171612 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2022-24302
**DESCRIPTION:**Paramiko could allow a remote attacker to obtain sensitive information, caused by a race condition in the write_private_key_file function. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222109 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2022-26488
**DESCRIPTION:**Python could allow a local authenticated attacker to gain elevated privileges on the system, caused by an issue when the search path is inadequately secured. By sending a specially-crafted request to add user-writable directories to the system search path, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221120 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2020-15084
**DESCRIPTION:**express-jwt could allow a remote attacker to bypass security restrictions, caused by improper enforcement of algorithms entry in the configuration. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass authorization.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/184368 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2022-1214
**DESCRIPTION:**REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225601 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

**IBM X-Force ID:**217313
**DESCRIPTION:**Nodejs node-forge module could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217313 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading.

Installed versions of IBM Spectrum Discover (2.0.4, 2.0.4.1, 2.0.4.2, 2.0.4.3, 2.0.4.4,2.0.4.5,2.0.4.6) can be upgraded to fixed version using IBM Spectrum Discover 2.0.4.7 upgrader. and following the steps provided in our documentation (IBM Spectrum Discover Documentation).

Workarounds and Mitigations

None