If an App Connect flow calls a URL at an endpoint controlled by a malicious user that also controls a Certificate Revocation List, those calls may trigger an application crash resulting in a denial of service.
CVEID:CVE-2020-1971
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERAL_NAME_cmp function contain an EDIPARTYNAME, an attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/192748 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Product(s) | Version(s) |
---|---|
App Connect Enterprise Certified Container | 1.0 with Operator |
App Connect Enterprise Certified Container | 1.1 with Operator |
App Connect Enterprise Certified Container 1.0 CD
Upgrade to App Connect Enterprise Certified Container to Operator version 1.2.0 (available in CASE 1.2.0) or higher, and ensure that any IntegrationServer and Designer components are at 11.0.0.11-r1 or higher.
App Connect Enterprise Certified Container 1.1 LTS
Upgrade to App Connect Enterprise Certified Container Operator version 1.1.1 EUS (available in CASE 1.1.1) or higher, and ensure that any IntegrationServer and Designer components are at 11.0.0.12-r1-eus or higher.
None