IBMA30BC3831CE7831A06A1D367F41E3A2440FB3BA2C7C313C814AAE3DCB52E6C5ESecurity Bulletin: IBM API Connect is impacted by vulnerabilities in Golang (CVE-2019-17596 CVE-2019-16276)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
Summary
IBM API Connect has addressed the following vulnerability.
Vulnerability Details
CVEID:CVE-2019-17596
**DESCRIPTION:**Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/170191 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2019-16276
**DESCRIPTION:**Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
CVSS Base score: 5.3
CVSS Temporal Score: See: <https://exchange.xforce.ibmcloud.com/vulnerabilities/167963> for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| API Connect | IBM API Connect V2018.4.1.0-2018.4.1.9 |
Remediation/Fixes
| Affected releases | Fixed in VRMF | APAR | Remediation / First Fix |
|---|---|---|---|
| IBM API Connect V2018.4.1.0-2018.4.1.9 |
v2018.4.1.9
iFix 1
|
LI81295
|
Addressed in IBM API Connect v2018.4.1.9 iFix 1.
Management server, Analytics and Developer Portal are impacted.
Follow this link and find the package appropriate for the form factor of your installation
http://www.ibm.com/support/fixcentral/swg/quickorder
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm api connect | eq | 2018.4.1.0 | |
| ibm api connect | eq | 2018.4.1.9 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N