Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to loss of confidentiality due to CVE-2021-4189

2022-06-2210:28:12

www.ibm.com

ibm app connect enterprise

container

designerauthoring

cve-2021-4189

python

ftp module

confidentiality

upgrade

documentation

vulnerability fix

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

55.6%

JSON

Summary

Python is included in the DesignerAuthoring component when Mapping Assist is enabled. The Python FTP module is vulnerable due to CVE-2021-4189. IBM App Connect Enterprise Certified Container is not directly vulnerable under standard operations, but custom use of the images may be vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability CVE-2021-4189.

Vulnerability Details

CVEID:CVE-2021-4189
**DESCRIPTION:**Python could allow a remote attacker to obtain sensitive information, caused by a flaw when using the FTP client library in PASV (passive) mode. By using a specially-crafted FTP server, an attacker could exploit this vulnerability to obtain service banner information from private network., and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/227269 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
App Connect Enterprise Certified Container	1.1-eus with Operator
App Connect Enterprise Certified Container	3.0 with Operator
App Connect Enterprise Certified Container	3.1 with Operator
App Connect Enterprise Certified Container	4.0 with Operator
App Connect Enterprise Certified Container	4.1 with Operator

Remediation/Fixes

App Connect Enterprise Certified Container 3.0, 3.1, 4.0 and 4.1 (Continuous Delivery)

Upgrade to App Connect Enterprise Certified Container Operator version 4.2.0 or higher, and ensure that all DesignerAuthoring components are at 12.0.4.0-r2 or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_cd?topic=releases-upgrading-operator>

App Connect Enterprise Certified Container 1.1 EUS (Extended Update Support)

Upgrade to App Connect Enterprise Certified Container Operator version 1.1.10 or higher, and ensure that all DesignerAuthoring components are at 11.0.0.18-r1-eus or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_eus?topic=releases-upgrading-operator>