Security Bulletin
Summary
Images built from the App Connect Enterprise Certified Container images that perform an npm install may leak information through their logs when installing from a non-default location using basic auth credentials due to CVE-2020-15095.
Vulnerability Details
Third Party Entry: 184666
DESCRIPTION: Node.js npm CLI module information disclosure
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/184666 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| App Connect Enterprise Certified Container | 1.0 with Operator |
| App Connect Enterprise Certified Container | 1.1 with Operator |
| App Connect Enterprise Certified Container | 1.2 with Operator |
Remediation/Fixes
App Connect Enterprise Certified Container 1.0 and 1.2 CD
Upgrade to App Connect Enterprise Certified Container to Operator version 1.3.0 (available in CASE 1.3.0) or higher, and ensure any new images are built from ACE images 11.0.0.11-r2 or higher.
App Connect Enterprise Certified Container 1.1 LTS
Upgrade to App Connect Enterprise Certified Container Operator version 1.1.1 EUS (available in CASE 1.1.1) or higher, and ensure any new images are built from ACE images 11.0.0.12-r1-eus or higher.
Workarounds and Mitigations
Avoid using credentials within the URL of any npm source modules when calling npm install.
This is only applicable if you build images using the App Connect Enterprise Certified Container images as a base, then perform an npm install and install packages from a non-default repository using credentials within the source URL.
Get Notified about Future Security Bulletins
References
Change History
09 Dec 2020: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
More support for:
IBM App Connect Enterprise
Software version:
1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1, 1.2
Operating system(s):
RedHat OpenShift
Document number:
6448444
Modified date:
29 April 2021
UID
ibm16448444