Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use Mapping Assistance may be vulnerable to CVE-2022-29404, CVE-2022-30522, CVE-2022-30556 and CVE-2022-31813

Summary

Apache HTTP Server is used by IBM App Connect Enterprise Certified Container for Mapping Assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use Mapping Assistance may be vulnerable to denial of service due to CVE-2022-29404 and CVE-2022-30522, loss of confidentiality due to CVE-2022-30556 and security restrictions bypassing due to CVE-2022-31813. This bulletin provides patch information to address the reported vulnerabilities CVE-2022-29404, CVE-2022-30522, CVE-2022-30556 and CVE-2022-31813 in Apache HTTP Server.

Vulnerability Details

CVEID:CVE-2022-29404
**DESCRIPTION:**Apache HTTP Server is vulnerable to a denial of service, caused by no default limit on possible input size. By sending a specially crafted request to a lua script that calls r:parsebody(0), an attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228339 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2022-30522
**DESCRIPTION:**Apache HTTP Server is vulnerable to a denial of service when configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large. By making excessively large memory allocations, a remote attacker could exploit this vulnerability to trigger an abort.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228338 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2022-30556
**DESCRIPTION:**Apache HTTP Server could allow a remote attacker to obtain sensitive information, caused by an error in mod_lua with websockets. An attacker could exploit this vulnerability to return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228336 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-31813
**DESCRIPTION:*Apache HTTP Server could allow a remote attacker to bypass security restrictions, caused by the failure to send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. An attacker could exploit this vulnerability to bypass IP based authentication on the origin server/application.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228337 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2 and 6.0 (Continuous Delivery)

Upgrade to App Connect Enterprise Certified Container Operator version 6.1.0 or higher, and ensure that all DesignerAuthoring components are at 12.0.6.0-r1 or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_cd?topic=releases-upgrading-operator&gt;

App Connect Enterprise Certified Container 5.0 LTS (Long Term Support)

Upgrade to App Connect Enterprise Certified Container Operator version 5.0.1 or higher, and ensure that all DesignerAuthoring components are at 12.0.6.0-r1-lts or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect-contlts?topic=releases-upgrading-operator&gt;

Workarounds and Mitigations

None