Security Bulletin: IBM App Connect Enterprise Certified Container operator may be vulnerable to CVE-2021-3121

Summary

GoGo Protobuf is used by the IBM App Connect Enterprise Certified Container operator. This bulletin provides patch information to address the reported vulnerability CVE-2021-3121 in GoGo Protobuf.

Vulnerability Details

CVEID:CVE-2021-3121
**DESCRIPTION:**An unspecified error with the lack of certain index validation, aka the skippy peanut butter issue in GoGo Protobuf has an unknown impact and attack vector.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/194539 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

App Connect Enterprise Certified Container 4.1 (Continuous Delivery)

Upgrade to App Connect Enterprise Certified Container Operator version 4.1.0 or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_cd?topic=releases-upgrading-operator&gt;

App Connect Enterprise Certified Container 5.0 LTS (Long Term Support)

Operator version 5.0 is not affected

Workarounds and Mitigations

None