Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM)

Summary

Security vulnerabilities have been reported for IBM SDK for Node.js. IBM Business Automation Workflow and IBM BPM include a stand-alone tool for editing configuration properties files that is based on IBM SDK for Node.js.

Vulnerability Details

CVEID:CVE-2019-15606
**DESCRIPTION:**Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have trailing OWS trimmed. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authorization based on header value comparisons.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/175914 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2019-15604
**DESCRIPTION:**Node.js is vulnerable to a denial of service, caused by improper certificate validation. By sending a specially-crafted X.509 certificate, a remote attacker could exploit this vulnerability to cause the process to abort.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/175912 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2019-15605
**DESCRIPTION:**Node.js vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/175913 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

Install interim fix JR61972 as appropriate for your current IBM Business Automation Workflow or IBM BPM version.

• IBM Business Automation Workflow
• IBM Business Process Manager Advanced
• IBM Business Process Manager Standard
• IBM Business Process Manager Express

For IBM Business Automation Workflow V18.0 and V19.0
· Upgrade to at least IBM Business Automation Workflow V19.0.0.2 as required by iFix and then apply iFix JR61972
--OR–
· Apply cumulative fix IBM Business Automation Workflow V20.0.0.1 (planned for end of Q2 2020)

For IBM BPM V8.6
· Upgrade to at least IBM BPM V8.6.0.0 CF 2017.12 as required by iFix and then apply iFix JR61972

**For IBM BPM V8.5 **· Upgrade to IBM BPM V8.5.7, apply Cumulative Fix 2017.06 and then apply iFix JR61972

Workarounds and Mitigations

IBM BPM Configuration Editor is a stand-alone tool for editing properties file. Use a standard text file editor instead.