IT33404: SECURITY APAR FOR CVE-2020-8172, CVE-2020-8174, CVEID: CVE-2020-11080

IBM Spectrum Control 5.4.0 (August 2020)

APAR status

• Closed as program error.

Error description

• [All] Node.js (including core and 3rd party modules) (Publicly
  disclosed vulnerability)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Control users                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See security bulletin for details of the vulnerabilities:    *
  * https://www.ibm.com/support/pages/node/6261327               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fix maintenance.                                       *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is targeted for the following release:
  
  IBM Spectrum Control 5.4.0   [ 5.4.0-IBM-SC ]
  
  ( release target 3Q 2020 / August )
  
  http://www.ibm.com/support/docview.wss?&uid=swg21320822
  
  The target dates for future releases do not represent a formal
  commitment by IBM. The dates are subject to change without
  notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels