Security Bulletin: IBM API Connect is impacted by a vulnerability in Drupal core (CVE-2021-32610)

Summary

IBM API Connect has addressed the following vulnerability.

Vulnerability Details

CVEID:CVE-2021-32610
**DESCRIPTION:**Drupal Core could allow a remote attacker to execute arbitrary code on the system, caused by the use of the third-party PEAR Archive_Tar library. By persuading a victim to opean specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/206016 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Affected Products and Versions

API Connect
| 10.0.1.0-10.0.1.3

Remediation/Fixes

IBM API Connect

V5.0.0.0-V5.0.8.12

| 5.0.8.12 iFix|

LI82292

|

Addressed in IBM API Connect V5.0.8.12 iFix published on or after July 23, 2021.

Developer Portal is impacted.

Follow this link and find the appropriate “Portal” package.

http://www.ibm.com/support/fixcentral/swg/quickorder

IBM API Connect

V2018.4.1.0-2018.4.1.16

| 2018.4.1.17|

LI82292

|

Addressed in IBM API Connect 2018.4.1.17.

Developer Portal is impacted.

Follow this link and find the appropriate “Portal” package.

http://www.ibm.com/support/fixcentral/swg/quickorder

IBM API Connect

v10.0.1.0-10.0.1.3

| 10.0.1.4|

LI82292

|

Addressed in IBM API Connect 10.0.1.4.

Developer Portal is impacted.

Follow this link and find the appropriate “Portal” package.

http://www.ibm.com/support/fixcentral/swg/quickorder

Workarounds and Mitigations

None