Lucene search

K
ibmIBM60E5D020A662F0FA4AFF58B0297AE0EE6485B68F17D359E72DF7399CF3356822
HistoryAug 16, 2021 - 3:05 p.m.

Security Bulletin: Vulnerabilities in Node.js in IBM DataPower Gateway

2021-08-1615:05:23
www.ibm.com
10

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

70.2%

Summary

IBM has addressed the following CVEs: CVE-2020-8287, CVE-2020-8265

Vulnerability Details

CVEID:CVE-2020-8287
**DESCRIPTION:**Node.js is vulnerable to HTTP request smuggling. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/194100 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:CVE-2020-8265
**DESCRIPTION:**Node.js is vulnerable to a denial of service, caused by a use-after-free in TLSWrap within the TLS implementation. By writing to a TLS enabled socket, an attacker could exploit this vulnerability to corrupt memory and cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/194101 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) - CVE-2020-8287
| Version(s)
—|—
IBM DataPower Gateway 10.0.1| 10.0.0.0-10.0.1.3
IBM DataPower Gateway 2018.4.1| 2018.4.1.0-2018.4.1.16
IBM DataPower Gateway V10 CD| 10.0.2.0

Affected Product(s) - CVE-2020-8265
| Version(s)
—|—
IBM DataPower Gateway 10.0.1| 10.0.0.0-10.0.1.3
IBM DataPower Gateway V10 CD| 10.0.2.0

Remediation/Fixes

Affected Product Fixed in Version APAR
IBM DataPower Gateway 10.0.1 10.0.1.4 IT37278

IBM DataPower Gateway 2018.4.1| 2018.4.1.17| IT37278
IBM DataPower Gateway V10 CD| 10.0.3.0| IT37278

Workarounds and Mitigations

None

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

70.2%