Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-39134)

2022-04-2219:38:18

www.ibm.com

ibm cloud private

node.js

vulnerability

cve-2021-39134

security update

fix pack

EPSS

0.001

Percentile

28.6%

JSON

Summary

Security Vulnerabilities affect IBM Cloud Private - Node.js

Vulnerability Details

CVEID:CVE-2021-39134
**DESCRIPTION:**Node.js @npmcli/arborist module could allow a local attacker to launch a symlink attack, caused by the failure of multiple dependencies to coexist within the same level in the node_modules hierarchy. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to create and overwrite arbitrary files on the system with elevated privileges.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/208462 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Cloud Private	3.2.1 CD
IBM Cloud Private	3.2.2 CD

Remediation/Fixes

Product defect fixes and security updates are only available for the two most recent Continuous Delivery (CD) update packages

IBM Cloud Private 3.2.1
IBM Cloud Private 3.2.2

For IBM Cloud Private 3.2.1, apply fix pack:

IBM Cloud Private 3.2.1.2203

For IBM Cloud Private 3.2.2, apply fix pack:

IBM Cloud Private 3.2.2.2203

For IBM Cloud Private 3.1.0, 3.1.1, 3.1.2, 3.2.0

Upgrade to the latest Continuous Delivery (CD) update package, IBM Cloud Private 3.2.2.
If required, individual product fixes can be made available between CD update packages for resolution of problems. Contact IBM support for assistance