Security Bulletin
Summary
IBM API Connect has addressed the following vulnerabilities.
Vulnerability Details
CVEID: CVE-2020-8557
DESCRIPTION: Kubernetes kubelet is vulnerable to a denial of service, caused by an issue with not including the /etc/hostsfile file by the kubelet eviction manager when calculating ephemeral storage usage. By writing a large amount of data to the /etc/hostsfile, a local authenticated attacker could exploit this vulnerability to fill the storage space of the node and cause the node to fail.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185301 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2020-8559
DESCRIPTION: Kubernetes kube-apiserver could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw when multiple clusters share the same certificate authority trusted by the client. By intercepting certain requests and sending a redirect response, an attacker could exploit this vulnerability to compromise other nodes.
CVSS Base score: 6.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/185302 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)
Affected Products and Versions
Affected Product(s) | Version(s) |
API Connect | API Connect V2018.4.1.0-V2018.4.1.12 |
API Connect | API Connect V10.0.0 |
Remediation/Fixes
Affected Product | Addressed in VRMF | APAR | Remediation/First Fix |
IBM API Connect V2018.4.1.0-V2018.4.1.12 |
IBM API Connect V2018.4.1.13
|
LI81762 |
Addressed in IBM API Connect V2018.4.1.13. All OVA components are impacted.
Follow this link and find the image appropriate for your installation.
|
IBM API Connect
V10.0.0
|
IBM API Connect
V10.0.1
|
LI81762 |
Addressed in IBM API Connect V10.0.1 |
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
07 Oct 2020: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
07 October 2020
UID
ibm16344297