Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to bypassing of access control based on IP addresses due to CVE-2021-29923

Summary

IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to bypassing of access control based on IP addresses due to CVE-2021-29923

Vulnerability Details

CVEID:CVE-2021-29923
**DESCRIPTION:**Golang Go could allow a remote attacker to bypass security restrictions, caused by improper consideration for extraneous zero characters at the beginning of an IP address octet. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass access control based on IP addresses.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/207025 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5

Upgrade to App Connect Enterprise Certified Container Operator version 2.0.0 (available in CASE 2.0.0) or higher, and ensure that all components are at 12.0.1.0-r4 or higher.

App Connect Enterprise Certified Container 1.1 LTS

Upgrade to App Connect Enterprise Certified Container Operator version 1.1.4 EUS (available in CASE 1.1.4) or higher, and ensure that all components are at 11.0.0.14-r1-eus or higher.

Workarounds and Mitigations

None