IBM API Connect has addressed the following vulnerabilities.
CVEID:CVE-2019-11045
**DESCRIPTION:**PHP could allow a remote attacker to bypass security restrictions, caused by an issue when DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. By using a specially-crafted filename, an attacker could exploit this vulnerability to bypass applications checking paths for the code is allowed to access.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173633 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVEID:CVE-2019-11044
**DESCRIPTION:**PHP could allow a remote attacker to bypass security restrictions, caused by an issue when link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. By using a specially-crafted filename, an attacker could exploit this vulnerability to bypass applications checking paths for the code is allowed to access.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173632 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVEID:CVE-2019-11046
**DESCRIPTION:**PHP could allow a remote attacker to obtain sensitive information, caused by improper input validation by the bcmath extension functions. By using a specially-crafted string containing characters that are numeric but not ASCII numbers, an attacker could exploit this vulnerability to obtain content of some memory locations, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173634 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Product(s) | Version(s) |
---|---|
API Connect | IBM API Connect V2018.4.1.0-2018.4.1.0 |
API Connect | IBM API Connect V5.0.0.0-5.0.8.7 |
Affected Product
|
Addressed in VRMF
|
APAR
|
Remediation / First Fix
—|—|—|—
IBM API Connect
V5.0.0.0-5.0.8.7
| 5.0.8.8| LI81408| Addressed in IBM API Connect V5.0.8.8.
Developer Portal is impacted.
Follow this link and find the “Portal” package:
http://www.ibm.com/support/fixcentral/swg/quickorder
IBM API Connect
V2018.4.1.0-2018.4.1.10
| 2018.4.1.11| LI81408|
Addressed in IBM API Connect V2018.4.1.11
Developer Portal is impacted.
Follow this link and find the “Portal” package:
http://www.ibm.com/support/fixcentral/swg/quickorder
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm api connect | eq | 5.0.0.0 | |
ibm api connect | eq | 5.0.8.7 | |
ibm api connect | eq | 2018.4.1.0 | |
ibm api connect | eq | 2018.4.1.10 |