Lucene search

K
ibmIBMD09099104FD73909B7A17C8A562A046B31FE40ED451593AC739AE369D3E4A1F7
HistoryJan 05, 2021 - 11:57 a.m.

Security Bulletin: IBM Cloud Pak for Integration is affected by multiple Node.js vulnerabilities

2021-01-0511:57:31
www.ibm.com
4

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

Summary

IBM Cloud Pak for Integration is vulnerable to Node.js CVE-2020-8251, CVE-2020-8201, and CVE-2020-8252, with details of each below.

Vulnerability Details

CVEID:CVE-2020-8201
**DESCRIPTION:**Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/188591 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:CVE-2020-8251
**DESCRIPTION:**Node.js is vulnerable to a denial of service, caused by delayed unfinished HTTP/1.1 requests submission. An attacker could exploit this vulnerability to make the server unable to accept new connections and exhaust all available resources.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/188592 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2020-8252
**DESCRIPTION:**Node.js is vulnerable to a buffer overflow, caused by improper bounds checking by the libuv’s fs.realpath.native. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/188593 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
Platform Navigator in IBM Cloud Pak for Integration (CP4I) All prior to 2020.4
Asset Repository in IBM Cloud Pak for Integration (CP4I) All prior to 2020.4

Remediation/Fixes

Platform Navigator****IBM Cloud Pak for Integration

Upgrade Platform Navigator to 2020.4.1.1-0 using the Operator upgrade process described in the Knowledge Center <https://www.ibm.com/support/knowledgecenter/SSGT7J_20.4/upgrade/upgrade_platform_navigator.html&gt;

Asset Repository****in IBM Cloud Pak for Integration

Upgrade Asset Repository to 2020.4.1.1-0 using the Operator upgrade process described in the Knowledge Center <https://www.ibm.com/support/knowledgecenter/SSGT7J_20.4/upgrade/upgrade_asset_repo.html&gt;

Workarounds and Mitigations

None

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N