Security Bulletin: Multiple vulnerabilities in Node.js affects IBM API Connect (CVE-2016-7099, CVE-2016-5325)

Summary

IBM API Connect is affected by three vulnerabilities in Node.js (CVE-2016-7099, CVE-2016-5325 and one for which a CVE ID was not assigned.) These vulnerabilities are now fixed.

Vulnerability Details

CVEID: CVE-2016-7099**
DESCRIPTION:** Node.js could allow a remote attacker to bypass security restrictions, caused by the improper verification of the host name. By sending a specially-crafted certificate containing wildcard characters, a remote attacker could exploit this vulnerability to gain access to the system.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/117538&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID: CVE-2016-5325**
DESCRIPTION:** Node.js is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input by the reason argument in ServerResponse#writeHead() function. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information.
CVSS Base Score: 6.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/117539&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID: Not Applicable**
DESCRIPTION:** Node.js could allow a local attacker to execute arbitrary code on the system, caused by the loading of third-party engine modules when the ENGINE_load_builtin_engines() function is used. By impersonating malicious code as a module, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 4.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/117537&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

IBM API Connect V5.0.0 - V5.0.4

Remediation/Fixes

Product

| VRMF|APAR|Remediation/First Fix
—|—|—|—
IBM API Connect| V5.0.0 - V5.0.4| LI79422 | Apply IBM API Connect V5.0.5.0 or later.

Workarounds and Mitigations

None