Security Bulletin: IBM App Connect Enterprise Certified Container Designers may be vulnerable to arbitrary code execution via CVE-2021-3757

Summary

IBM App Connect Enterprise Certified Container may be vulnerable to arbitrary code execution via CVE-2021-3757. This only affects App Connect Designers

Vulnerability Details

CVEID:CVE-2021-3757
**DESCRIPTION:**Node.js immer module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code, obtain sensitive information or cause a denial of service condition on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/208684 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5

Upgrade to App Connect Enterprise Certified Container Operator version 2.0.0 (available in CASE 2.0.0) or higher, and ensure that all Designer components are at 12.0.1.0-r4 or higher.

App Connect Enterprise Certified Container 1.1 LTS

Upgrade to App Connect Enterprise Certified Container Operator version 1.1.4 EUS (available in CASE 1.1.4) or higher, and ensure that all Designer components are at 11.0.0.13-r3-eus or higher.

Workarounds and Mitigations

None