Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to arbitrary code execution [CVE-2022-25255]

Summary

Qt for Linux is not used directly by IBM App Connect Enterprise Certified Container but it is included as an operating system package in the images. IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to arbitrary code execution. This bulletin provides patch information to address the reported vulnerability [CVE-2022-25255] in Qt for Linux.

Vulnerability Details

CVEID:CVE-2022-25255
**DESCRIPTION:**Qt for Linux and UNIX could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the QProcess when not found in the PATH. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code from the current working directory.
CVSS Base score: 9.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219786 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends the following:

App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2 and 6.0 (Continuous Delivery)

Upgrade to App Connect Enterprise Certified Container Operator version 6.1.0 or higher, and ensure that all components are at 12.0.6.0-r1 or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_cd?topic=releases-upgrading-operator&gt;

App Connect Enterprise Certified Container 5.0 LTS (Long Term Support)

Upgrade to App Connect Enterprise Certified Container Operator version 5.0.1 or higher, and ensure that all components are at 12.0.6.0-r1-lts or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect-contlts?topic=releases-upgrading-operator&gt;

Workarounds and Mitigations

None