Security Bulletin: Vulnerabilities in Node.js affect IBM Integration Bus v10 (CVE-2021-37712)

Summary

IBM Integration Bus ships with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below.

Vulnerability Details

CVEID:CVE-2021-37712
**DESCRIPTION:**Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by an arbitrary file creation/overwrite vulnerability. By creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, an attacker could use an untrusted tar file to symlink into an arbitrary location and extract arbitrary files into that location to create or overwrite arbitrary files and execute arbitrary code on the system.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/208450 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)

Affected Products and Versions

IBM Integration Bus V10 , V10.0.0.0 - V10.0.0.24 ( Linux on Intel x86-64 and Windows 64-bit only)

Remediation/Fixes

Product

|

VRMF

| APAR|

Remediation / Fix

—|—|—|—
IBM Integration Bus
| V10.0.0.0-V10.0.0.24| IT38593| Interim fix for APAR (IT38593) is available from

IBM Fix Central

Workarounds and Mitigations

None