IBM Support

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to string injection vulnerability due to Node.js (CVE-2021-44532, CVE-2021-44532 )

Security Bulletin


Summary

String injection vulnerabilities in Node.js - CVE-2021-44532, CVE-2021-44532, has been identified that affects IBM Watson Assistant for IBM Cloud Pak for Data. Node.js is used as cross-platform runtime environment by IBM Watson Assistant for IBM Cloud Pak for Data. The fix includes version 12.22.9, 12.22.11. Refer to details for additional information.

Vulnerability Details

CVEID:   CVE-2021-44532
DESCRIPTION:   Node.js could allow a remote attacker to bypass security restrictions, caused by a string injection vulnerability when name constraints were used within a certificate chain. An attacker could exploit this vulnerability to bypass the name constraints.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/216931 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2021-44533
DESCRIPTION:   Node.js could allow a remote attacker to bypass security restrictions, caused by the incorrect handling of multi-value Relative Distinguished Names. By crafting certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, an attacker could exploit this vulnerability to bypass the certificate subject verification.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/216932 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2022-21824
DESCRIPTION:   Node.js could provide weaker than expected security, caused by an error related to the formatting logic of the console.table() function. An attacker could exploit this vulnerability using console.table properties to allow an empty string to be assigned to numerical keys of the object prototype.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/216933 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)Version(s)
Watson Assistant for IBM Cloud Pak for Data4.0.0. 4.0.2, 4.0.4, 4.0.5, 4.0.6, 4.0.7

Remediation/Fixes

For all affected versions, IBM strongly recommends addressing the vulnerability now by upgrading to the latest (v4.0.8) release of IBM Watson Assistant for IBM Cloud Pak for Data which maintains backward compatibility with the versions listed above.

Product Latest VersionRemediation/Fix/Instructions
 IBM Watson Assistant for IBM Cloud Pak for Data 4.0.8

Follow instructions for Installing Watson Assistant in Link to Release (v4.0.8 release information)

https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=assistant-installing-watson

 

 

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Change History

04 May 2022: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU055","label":"Cognitive Applications"},"Product":{"code":"SSWTLZ","label":"Watson Developer Cloud"},"Component":"","Platform":[{"code":"PF040","label":"RedHat OpenShift"}],"Version":"4.0.0-4.0.7","Edition":""}]

Document Information

Modified date:
09 May 2022

UID

ibm16584189