Security Bulletin: Vulnerability in the Node.js got module affects IBM Event Streams (CVE-2022-33987)

Summary

This security vulnerability affects the Node.js got module that is used by IBM Event Streams.

Vulnerability Details

CVEID:CVE-2022-33987
**DESCRIPTION:**Node.js got module could allow a remote attacker to bypass security restrictions, caused by an unspecified. By sending a specially-crafted request, an attacker could exploit this vulnerability to perform a redirect to a UNIX socket.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/229246 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading

Upgrade to IBM Event Streams 11.0.3 by following the upgrading and migrating documentation.

Workarounds and Mitigations

None