Security Bulletin: IBM App Connect Enterprise is vulnerable to Improper Input Validation due to electron (CVE-2022-29257)

Summary

IBM App Connect Enterprise is vulnerable to Improper Input Validation due to electron (CVE-2022-29257). Electron is used for Discovery Connectors in IBM App Connect Enterprise. The latest fix pack includes electron 19.0.10.

Vulnerability Details

CVEID:CVE-2022-29257
**DESCRIPTION:**Node.js electron module could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the code signing validation check. By serving maliciously-crafted update packages, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 6.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228982 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)

|

Version(s)

—|—

IBM App Connect Enterprise

|

12.0.1.0 - 12.0.5.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying the appropriate fix to IBM App Connect Enterprise

Product(s)

|

Version(s)

|

APAR

|

Remediation / Fix

—|—|—|—

IBM App Connect Enterprise

|

v12.0.1.0 - v12.0.5.0

|

IT42205

|

This APAR (IT42205) is available in IBM App Connect Enterprise 12.0.6.0

IBM download link - IBM App Connect Enterprise v12.0.6.0

Workarounds and Mitigations

None