Images built from the App Connect Enterprise Certified Container images that perform an npm install may leak information through their logs when installing from a non-default location using basic auth credentials due to CVE-2020-15095.
**Third Party Entry:**184666
**DESCRIPTION:**Node.js npm CLI module information disclosure
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/184666 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected Product(s) | Version(s) |
---|---|
App Connect Enterprise Certified Container | 1.0 with Operator |
App Connect Enterprise Certified Container | 1.1 with Operator |
App Connect Enterprise Certified Container | 1.2 with Operator |
App Connect Enterprise Certified Container 1.0 and 1.2 CD
Upgrade to App Connect Enterprise Certified Container to Operator version 1.3.0 (available in CASE 1.3.0) or higher, and ensure any new images are built from ACE images 11.0.0.11-r2 or higher.
App Connect Enterprise Certified Container 1.1 LTS
Upgrade to App Connect Enterprise Certified Container Operator version 1.1.1 EUS (available in CASE 1.1.1) or higher, and ensure any new images are built from ACE images 11.0.0.12-r1-eus or higher.
Avoid using credentials within the URL of any npm source modules when calling npm install.
This is only applicable if you build images using the App Connect Enterprise Certified Container images as a base, then perform an npm install and install packages from a non-default repository using credentials within the source URL.