Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to CVEs

Summary

Cloud Pak for Security (CP4S) v1.7.2.0 and earlier uses a packages that are vulnerable to denial of service attack, and allow an authenticated user to obtain additional informationin HTTP responses, which could potentially be used in an attack against the system. These issues have been addressed in an update. See the Fixes section below for instructions.

Vulnerability Details

CVEID:CVE-2021-39013
**DESCRIPTION:**IBM Cloud Pak for Security (CP4S) could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213651 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2020-15168
**DESCRIPTION:**Node.js node-fetch module is vulnerable to a denial of service, caused by the failure to honor the size option after following a redirect. By using a specially-crafted file, a remote attacker could exploit this vulnerability to consume excessive resource on the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/188155 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Please upgrade to CP4S 1.8.0.0 following instructions at <https://www.ibm.com/docs/en/SSTDPP_1.8/docs/security-pak/upgrading.html&gt;

Workarounds and Mitigations

None