Lucene search

K
ibmIBM589D6A8F09B2A9ACD73BF2AB4593A1EBB38C8B1AA2D7BA19F407D664B7222097
HistoryJan 27, 2023 - 10:09 a.m.

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to [CVE-2022-23491]

2023-01-2710:09:14
www.ibm.com
16

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

22.8%

Summary

Python module certifi is used by IBM App Connect Enterprise Certified Container for mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to verifying untrustworth certificates. This bulletin provides patch information to address the reported vulnerability in Python module certifi. [CVE-2022-23491]

Vulnerability Details

CVEID:CVE-2022-23491
**DESCRIPTION:**An unspecified error in with TrustCor’s ownership also operated a business that produced spyware in Certifi has an unknown impact and attack vector.
CVSS Base score: 6.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241627 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
App Connect Enterprise Certified Container 4.1
App Connect Enterprise Certified Container 4.2
App Connect Enterprise Certified Container 5.0-lts
App Connect Enterprise Certified Container 5.1
App Connect Enterprise Certified Container 5.2
App Connect Enterprise Certified Container 6.0
App Connect Enterprise Certified Container 6.1
App Connect Enterprise Certified Container 6.2

Remediation/Fixes

IBM strongly suggests the following:
App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1 and 6.2 (Continuous Delivery)

Upgrade to App Connect Enterprise Certified Container Operator version 7.0.0 or higher, and ensure that all DesignerAuthoring components are at 12.0.7.0-r2 or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_cd?topic=releases-upgrading-operator&gt;

App Connect Enterprise Certified Container 5.0 LTS (Long Term Support)

Upgrade to App Connect Enterprise Certified Container Operator version 5.0.3 or higher, and ensure that all DesignerAuthoring components are at 12.0.7.0-r1-lts or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect-contlts?topic=releases-upgrading-operator&gt;

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmapp_connect_enterpriseMatch4.1
OR
ibmapp_connect_enterpriseMatch4.2
OR
ibmapp_connect_enterpriseMatch5.0
OR
ibmapp_connect_enterpriseMatch5.1
OR
ibmapp_connect_enterpriseMatch5.2
OR
ibmapp_connect_enterpriseMatch6.0
OR
ibmapp_connect_enterpriseMatch6.1
OR
ibmapp_connect_enterpriseMatch6.2

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

22.8%