Lucene search

K
ibmIBM6128A13C04F8ECEA7D864C9BB4042D04376F9E25186BB47D9F6B544820BE25EE
HistoryFeb 18, 2020 - 8:19 p.m.

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - lodash (CVE-2019-10744)

2020-02-1820:19:59
www.ibm.com
14

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

Summary

A Security Vulnerability affects IBM Cloud Private - lodash

Vulnerability Details

CVEID:CVE-2019-10744
**DESCRIPTION:**Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/167415 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Cloud Private 3.2.1 CD
IBM Cloud Private 3.2.0 CD

Remediation/Fixes

Product defect fixes and security updates are only available for the two most recent Continuous Delivery (CD) update packages

  • IBM Cloud Private 3.2.0
  • IBM Cloud Private 3.2.1

For IBM Cloud Private 3.2.0, apply January fix pack:

For IBM Cloud Private 3.2.1, apply January fix pack:

For IBM Cloud Private 3.1.0, 3.1.1, 3.1.2:

  • Upgrade to the latest Continuous Delivery (CD) update package, IBM Cloud Private 3.2.1.
  • If required, individual product fixes can be made available between CD update packages for resolution of problems. Contact IBM support for assistance

Workarounds and Mitigations

None

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

Related for 6128A13C04F8ECEA7D864C9BB4042D04376F9E25186BB47D9F6B544820BE25EE