Security Bulletin: IBM DataPower affected by vulnerabilities in Node.js

Summary

IBM has addressed the following CVEs that affect the APIC Gateway Service.

Vulnerability Details

CVEID:CVE-2021-22959
**DESCRIPTION:**Node.js is vulnerable to HTTP request smuggling, caused by an error related to a space in headers. A remote attacker could send a specially-crafted request with a space (SP) right after the header name before the colon to lead to HTTP Request Smuggling (HRS). An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211168 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2021-22960
**DESCRIPTION:**Node.js is vulnerable to HTTP request smuggling, caused by an error when parsing the body of chunked requests. A remote attacker could send a specially-crafted request to lead to HTTP Request Smuggling (HRS). An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211171 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

Fix appears in IBM DataPower Gateway versions 10.0.4.0 and 10.0.1.6. APAR: IT39615

Workarounds and Mitigations

Configure TLS between APIM and the IBM DataPower Gateway to use client-certificate authentication (see <https://www.ibm.com/docs/en/datapower-gateway/10.0.1?topic=connect-configuring-api-gateway-service&gt;). Specify a valcred that will validate only the certificate(s) configured for APIM.