Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

@candlelabs/sdk (>=1.0.1, <=1.0.2), candlelabssdk (1.0.0) potentially affected by CVE-2022-0722 via parse-url (6.0.0)

parse-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - @candlelabs/sdk =1.0.1, =1.0.2 - candlelabssdk 1.0.0 Source cves: CVE-2022-0722 Source advisory: OSV:GHSA-4P35-CFCX-8653...

CVE-2022-0722 Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-url

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0...

CVE-2022-0722

CVE-2022-0722 affects the parse-url library in the GitHub repo ionicabizau/parse-url prior to version 7.0.0, enabling exposure of sensitive information to an unauthorized actor. The vulnerability is a client-visible information disclosure, capable of being triggered by crafted requests that leak ...