Lucene search

K
ibmIBM739CA5C6D16CE009AAFC14E0DAB80D8EBA9CBB48EA41646D45E1273B10FA59FF
HistoryApr 29, 2021 - 11:13 a.m.

Security Bulletin: Images built from IBM App Connect Enterprise Certified Container images may be vulnerable to information exposure via CVE-2020-15095

2021-04-2911:13:31
www.ibm.com
15
images vulnerability
cve-2020-15095
upgrade
fixed versions
credentials
npm urls

EPSS

0.001

Percentile

17.2%

Summary

Images built from the App Connect Enterprise Certified Container images that perform an npm install may leak information through their logs when installing from a non-default location using basic auth credentials due to CVE-2020-15095.

Vulnerability Details

**Third Party Entry:**184666
**DESCRIPTION:**Node.js npm CLI module information disclosure
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/184666 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
App Connect Enterprise Certified Container 1.0 with Operator
App Connect Enterprise Certified Container 1.1 with Operator
App Connect Enterprise Certified Container 1.2 with Operator

Remediation/Fixes

App Connect Enterprise Certified Container 1.0 and 1.2 CD

Upgrade to App Connect Enterprise Certified Container to Operator version 1.3.0 (available in CASE 1.3.0) or higher, and ensure any new images are built from ACE images 11.0.0.11-r2 or higher.

App Connect Enterprise Certified Container 1.1 LTS

Upgrade to App Connect Enterprise Certified Container Operator version 1.1.1 EUS (available in CASE 1.1.1) or higher, and ensure any new images are built from ACE images 11.0.0.12-r1-eus or higher.

Workarounds and Mitigations

Avoid using credentials within the URL of any npm source modules when calling npm install.

This is only applicable if you build images using the App Connect Enterprise Certified Container images as a base, then perform an npm install and install packages from a non-default repository using credentials within the source URL.