Lucene search

K
ibmIBMBA115DC647AD58068A81D5DEF13A4806EBC639858B1743428BF24FE678B87926
HistoryApr 22, 2022 - 1:35 p.m.

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22898)

2022-04-2213:35:52
www.ibm.com
25
ibm cloud private
curl libcurl
3.2.1 cd
3.2.2 cd
sensitive information
security updates
fix packs
remote attacker
vulnerability
network protocol
attack launch
individual product fixes
continuous delivery
upgrade package

EPSS

0.002

Percentile

58.3%

Summary

Security Vulnerabilities affect IBM Cloud Private - curl

Vulnerability Details

CVEID:CVE-2021-22898
**DESCRIPTION:**cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a flaw in the option parser for sending NEW_ENV variables. By sending a specially-crafted request using a clear-text network protocol, an attacker could exploit this vulnerability to obtain sensitive internal information to the server, and use this information to launch further attacks against the affected system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202562 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Cloud Private 3.2.1 CD
IBM Cloud Private 3.2.2 CD

Remediation/Fixes

Product defect fixes and security updates are only available for the two most recent Continuous Delivery (CD) update packages

  • IBM Cloud Private 3.2.1
  • IBM Cloud Private 3.2.2

For IBM Cloud Private 3.2.1, apply fix pack:

For IBM Cloud Private 3.2.2, apply fix pack:

For IBM Cloud Private 3.1.0, 3.1.1, 3.1.2, 3.2.0

  • Upgrade to the latest Continuous Delivery (CD) update package, IBM Cloud Private 3.2.2.
  • If required, individual product fixes can be made available between CD update packages for resolution of problems. Contact IBM support for assistance

Workarounds and Mitigations

None

VendorProductVersionCPE
ibmcloud_private3.2.1cpe:2.3:a:ibm:cloud_private:3.2.1:*:*:*:*:*:*:*
ibmcloud_private3.2.2cpe:2.3:a:ibm:cloud_private:3.2.2:*:*:*:*:*:*:*