Security Bulletin: IBM Integration Bus affected by multiple Apache Tomcat vulnerabilities.

Summary

IBM Integration Bus ships Apache Tomcat which is susceptible to vulnerabilities which were reported and have been addressed.

Vulnerability Details

CVEID:CVE-2020-1935
**DESCRIPTION:**Apache Tomcat is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/176788 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2019-17569
**DESCRIPTION:**Apache Tomcat is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/176784 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

IBM Integration Bus V10.0.0.0 - V10.0.0.20
IBM Integration Bus V9.0.0.0 - V9.0.0.11

Remediation/Fixes

The APAR is available in fix pack 10.0.0.21

IBM Integration Bus V10.0 - Fix Pack 10.0.0.21

IBM Integration Bus| V9.0.0.0 - V9.0.0.11| IT31818 | Contact IBM support to request for Fix APAR

Workarounds and Mitigations

None