Security Bulletin: Multiple Security Vulnerabilities affect IBM Cloud Private (CVE-2019-5739 CVE-2019-5737 CVE-2019-1559)

Summary

IBM Cloud Private is vulnerable to multiple security vulnerabilities in Node.js

Vulnerability Details

CVEID: CVE-2019-1559 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding. An attacker could exploit this vulnerability using a 0-byte record padding-oracle attack to decrypt traffic.
CVSS Base Score: 5.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/157514&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

CVEID: CVE-2019-5737 DESCRIPTION: Node.js is vulnerable to a denial of service. By establishing an HTTP or HTTPS connection in keep-alive mode and sending headers very slowly to force the connection and associated resources to stay alive for a long period of time, a remote attacker could exploit this vulnerability to consume all available resources.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/158093&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-5739 DESCRIPTION: Node.js is vulnerable to a denial of service. By establishing an HTTP or HTTPS connection in keep-alive mode forcing the connection to remain open and inactive for up to 2 minutes, a remote attacker could exploit this vulnerability to consume all available resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/158096&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

• IBM Cloud Private 2.1.x, 3.1.0, 3.1.1, 3.1.2

Remediation/Fixes

Product defect fixes and security updates are only available for the two most recent Continuous Delivery (CD) update packages

• IBM Cloud Private 3.1.2
• IBM Cloud Private 3.1.1

For IBM Cloud Private 3.1.2

• Apply these patches:
  • IBM Cloud Private 3.1.2 Patch - Metering
  • IBM Cloud Private 3.1.2 Patch - Platform-ui
  • IBM Cloud Private 3.1.2 Patch - Vulnerability Advisor
  • IBM Cloud Private 3.1.2 Patch - Auth-pap
  • IBM Cloud Private 3.1.2 Patch - Auth-idp
  • IBM Cloud Private 3.1.2 Patch - Catalog-ui
  • IBM Cloud Private 3.1.2 Patch - Logging
  • IBM Cloud Private 3.1.2 Patch - Helm-api
  • IBM Cloud Private 3.1.2 Patch - Helm-repo
  • IBM Cloud Private 3.1.2 Patch - Mgmt-repo

For IBM Cloud Private 3.1.1

• Apply these patches:
  • IBM Cloud Private 3.1.1 Patch - Metering
  • IBM Cloud Private 3.1.1 Patch - Platform-ui
  • IBM Cloud Private 3.1.1 Patch - Vulnerability Advisor
  • IBM Cloud Private 3.1.1 Patch - Auth-pap
  • IBM Cloud Private 3.1.1 Patch - Auth-idp
  • IBM Cloud Private 3.1.1 Patch - Catalog-ui
  • IBM Cloud Private 3.1.1 Patch - Logging
  • IBM Cloud Private 3.1.1 Patch - Helm-api
  • IBM Cloud Private 3.1.1 Patch - Helm-repo
  • IBM Cloud Private 3.1.1 Patch - Mgmt-repo

For IBM Cloud Private, 2.1.x, 3.1.0:

• Upgrade to the latest Continuous Delivery (CD) update package, IBM Cloud Private 3.2.
• If required, individual product fixes can be made available between CD update packages for resolution of problems. Contact IBM support for assistance

Workarounds and Mitigations

None