Security Bulletin: IBM MaaS360 Cloud Extender Configuration Utility and Mobile Enterprise Gateway have vulnerability (CVE-2021-43797)

Summary

A vulnerability contained within a 3rd party component was identified and remediated in the IBM MaaS360 Mobile Enterprise Gateway and MaaS360 Cloud Extender Configuration Utility module.

Vulnerability Details

CVEID:CVE-2021-43797
**DESCRIPTION:**Netty is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header names. By sending a specially-crafted HTTP(S) transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215118 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

Update the IBM MaaS360 Mobile Enterprise Gateway and the MaaS360 Cloud Extender Configuration Utility Module to version 2.106.400 or higher.

Instructions on how to upgrade the IBM MaaS360 Mobile Enterprise Gateway is located on this IBM Documentation page. Instructions on how to upgrade the IBM MaaS360 Cloud Extender Configuration Utility Module is located on this IBM Documentation page.

Workarounds and Mitigations

None