Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules tough-cookie and semver (CVE-2023-26136, CVE-2022-25883).

Summary

IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules tough-cookie and semver (CVE-2023-26136, CVE-2022-25883). The fix includes versions tough-cookie >=4.1.3 & semver >=7.5.4 and 5.7.2

Vulnerability Details

CVEID:CVE-2023-26136
**DESCRIPTION:**Salesforce tough-cookie could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/259555 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2022-25883
**DESCRIPTION:**Node.js semver package is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the new Range function. By providing specially crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/258647 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying the appropriate fix to IBM App Connect Enterprise

*Please Note: There are 2 parts to the downloaded fix IT44228, which is available to apply to 12.0.9.0

1. IT44228 should be downloaded by all Runtime users.
2. IT44228A should be downloaded, in addition to IT44228, by users who install 3rd party LoopBack connectors.
   Affected Product(s)| Version(s)| APAR| Remediation / Fixes
   —|—|—|—
   IBM App Connect Enterprise| 12.0.1.0 - 12.0.9.0| IT44228|

Interim fix for APAR (IT44228) is available to apply to 12.0.9.0 from

IBM Fix Central

IBM App Connect Enterprise| 11.0.0.1 - 11.0.0.21|

IT44228

|

The APAR (IT44228) is available from

IBM App Connect Enterprise v11 - Fix Pack 11.0.0.22

Workarounds and Mitigations

None