IBM46E265EF279A2B5F9D4E94DDA790232FBD2EF0C9C475E7E192A6D8406DD4DD85Security Bulletin: IBM API Connect is impacted by a denial of service vulnerability in MySQL (CVE-2020-2752)
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:N/I:N/A:P
Summary
IBM API Connect has addressed the following vulnerability.
Vulnerability Details
CVEID:CVE-2020-2752
**DESCRIPTION:**An unspecified vulnerability in Oracle MySQL related to the Client C API component could allow an authenticated attacker to cause a denial of service resulting in a high availability impact using unknown attack vectors.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179652 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| API Connect | V2018.4.1.0-2018.4.1.11 |
| API Connect | IBM API Connect V5.0.0.0-5.0.8.8 |
Remediation/Fixes
| Affected releases | Fixed in VRMF | APAR | Remediation / First Fix |
|---|---|---|---|
| IBM API Connect V2018.1-2018.4.1.11 |
v2018.4.1.12
|
LI81650
|
Addressed in IBM API Connect v2018.4.1.12.
Developer Portal is impacted.
Follow this link and find the “Portal” package.
http://www.ibm.com/support/fixcentral/swg/quickorder
IBM API Connect
V5.0.0.0-5.0.8.8
|
5.0.8.8 iFix released on
June 18, 2020 or later
| LI81650|
Addressed in IBM API Connect V5.0.8.8 iFix
released on June 18, 2020 or later
Developer Portal is impacted.
Follow this link and find the “Portal” package.
http://www.ibm.com/support/fixcentral/swg/quickorder
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm api connect | eq | 5.0.0.0 | |
| ibm api connect | eq | 5.0.8.8 | |
| ibm api connect | eq | 2018.4.1.0 | |
| ibm api connect | eq | 2018.4.1.11 |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:N/I:N/A:P