Security Bulletin: OpenPages with Watson has addressed Node.js vulnerability (CVE-2022-32213)

Summary

Node.js is not used by IBM OpenPages with Watson core product however it is used by the installer server and agents components. A HTTP request smuggling vulnerability in Node.js is addressed within OpenPages with Watson.

Vulnerability Details

CVEID:CVE-2022-32213
**DESCRIPTION:**Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly parse and validate Transfer-Encoding headers by the llhttp parser in the http module. A remote attacker could send a specially-crafted request to lead to HTTP Request Smuggling (HRS). An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230657 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

A fix has been created for each affected version of the named product. Download and install the fix as soon as possible. Fixes and installation instructions are provided at the URLs listed below:

Product

|

Remediation

—|—

For IBM OpenPages with Watson 8.3

- Apply 8.3 FixPack 2 **(8.3.0.2)**then,

- Apply 8.3 Interim Fix 1 (8.3.0.2.1) or later

|

Download URL for 8.3.0.2

https://www.ibm.com/support/pages/openpages-watson-83-fix-pack-2

Download URL for 8.3.0.2.1

https://www.ibm.com/support/pages/openpages-watson-8302-interim-fix-1

Workarounds and Mitigations

For IBM OpenPages with Watson 8.3 through 8.3.0.2, stop Installer agents and Installation server.