Security Bulletin: Images built from IBM App Connect Enterprise Certified Container images may be vulnerable to information exposure via CVE-2020-15095

Summary

Images built from the App Connect Enterprise Certified Container images that perform an npm install may leak information through their logs when installing from a non-default location using basic auth credentials due to CVE-2020-15095.

Vulnerability Details

**Third Party Entry:**184666
**DESCRIPTION:**Node.js npm CLI module information disclosure
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/184666 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

App Connect Enterprise Certified Container 1.0 and 1.2 CD

Upgrade to App Connect Enterprise Certified Container to Operator version 1.3.0 (available in CASE 1.3.0) or higher, and ensure any new images are built from ACE images 11.0.0.11-r2 or higher.

App Connect Enterprise Certified Container 1.1 LTS

Upgrade to App Connect Enterprise Certified Container Operator version 1.1.1 EUS (available in CASE 1.1.1) or higher, and ensure any new images are built from ACE images 11.0.0.12-r1-eus or higher.

Workarounds and Mitigations

Avoid using credentials within the URL of any npm source modules when calling npm install.

This is only applicable if you build images using the App Connect Enterprise Certified Container images as a base, then perform an npm install and install packages from a non-default repository using credentials within the source URL.