## Summary
Node.js is used by all IBM App Connect Enterprise Certified Container components as a runtime engine. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service, security restriction bypassing, cross-site script attack, cache poisoning, session hijacking, HTTP response splitting and HTTP header injection. This bulletin provides patch information to address the reported vulnerabilities in Node.js. [CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807]
## Vulnerability Details
** CVEID: **[CVE-2023-23920]()
** DESCRIPTION: **Node.js could allow a remote authenticated attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request using ICU_DATA environment variable, an attacker could exploit this vulnerability to search and potentially load ICU data.
CVSS Base score: 2.7
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/247694]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
** CVEID: **[CVE-2023-24807]()
** DESCRIPTION: **Node.js is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Headers.set() and Headers.append() methods in the fetch API. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/247695]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
** CVEID: **[CVE-2023-23936]()
** DESCRIPTION: **Node.js is vulnerable to CRLF injection, caused by a flaw in the fetch API. By sending a specially-crafted HTTP response containing CRLF character sequences, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning, session hijacking, HTTP response splitting or HTTP header injection.
CVSS Base score: 6.5
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/247696]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
** CVEID: **[CVE-2023-23919]()
** DESCRIPTION: **Node.js is vulnerable to a denial of service, caused by not clear the OpenSSL error stack after operations. By sending specially-crafted cryptographic operations, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.9
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/247697]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
## Affected Products and Versions
Affected Product(s)| Version(s)
—|—
App Connect Enterprise Certified Container| 4.1
App Connect Enterprise Certified Container| 4.2
App Connect Enterprise Certified Container| 5.0-lts
App Connect Enterprise Certified Container| 5.1
App Connect Enterprise Certified Container| 5.2
App Connect Enterprise Certified Container| 6.0
App Connect Enterprise Certified Container| 6.1
App Connect Enterprise Certified Container| 6.2
App Connect Enterprise Certified Container| 7.0
App Connect Enterprise Certified Container| 7.1
App Connect Enterprise Certified Container| 7.2
App Connect Enterprise Certified Container| 8.0
## Remediation/Fixes
IBM strongly suggests the following:
App Connect Enterprise Certified Container 4.1.x to 8.0.x (Continuous Delivery)
Upgrade to App Connect Enterprise Certified Container Operator version 8.1.0 or higher, and ensure that all components are at 12.0.8.0-r1 or higher. Documentation on the upgrade process is available at
App Connect Enterprise Certified Container 5.0 LTS (Long Term Support)
Upgrade to App Connect Enterprise Certified Container Operator version 5.0.6 or higher, and ensure that all components are at 12.0.8.0-r1-lts or higher. Documentation on the upgrade process is available at
## Workarounds and Mitigations
None
References
Back to Main
