IBMFE4F33A4770F50A9E54A773DABFF605A127BD15AC0E4A99FA9BFE726ABEE17B2Security Bulletin: IBM API Connect is impacted by a vulnerability in Kubernetes (CVE-2019-11251)
5.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
Summary
IBM API Connect has addressed the following vulnerability.
Vulnerability Details
CVEID:CVE-2019-11251
**DESCRIPTION:**Kubernetes could allow a remote attacker to gain unauthorized access to the system, caused by an error in kubectl cp that allows a combination of two symlinks to copy a file outside of its destination directory. An attacker could exploit this vulnerability to write arbitrary files outside of the destination tree.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/168617 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM API Connect | 2018.4.1.8 |
Remediation/Fixes
| Affected releases | Fixed in VRMF | APAR | Remediation / First Fix |
|---|---|---|---|
| IBM API Connect V2018.4.1.0-2018.4.1.8 |
v2018.4.1.9
|
LI81314
|
Addressed in IBM API Connect v2018.4.1.9.
All components deployed on Kubernetes are impacted.
Follow this link and find the package appropriate for your installation.
http://www.ibm.com/support/fixcentral/swg/quickorder?
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm api connect | eq | 2018.4.1.0 | |
| ibm api connect | eq | 2018.4.1.8 |
Related
5.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N