Security Bulletin: IBM Sterling Transformation Extender is affected by MongoBleed security vulnerability

Workarounds and Mitigations

To mitigate this vulnerability, customers should either limit network message compression to 'snappy' (thereby excluding 'zlib') or disable compression entirely. Detailed workarounds for ITX Design Server Docker and Native installations are provided in the following sections.

Workaround for ITX Design Server Docker installations

To address this critical vulnerability in the MongoDB server, adjustments are necessary for the ITX Design Server install script used in Docker installations. The procedure below outlines the modifications required to restrict compression methods to only Snappy.

    
Prerequisites

1. Ensure ITX Design Server is installed and running.
   • Verify by running: ./ITX status (all components should show as running)
2. Before updating the installation script, run and save the output of the following two commands:
   docker exec tx-server-mongo ps -ef
docker exec tx-server-mongo mongo --quiet --eval "db.serverStatus().network.compression"

    
Procedure

1. Navigate to ITX install directory
   cd <ITX install directory> 
2. Create a backup of the existing installation script
   
   • For ITX Design Server versions 10.1.0.2, 10.1.1.1 and 10.1.2.1:
     Create the backup of install.sh script
     cp install.sh <backup_location>/install.sh
For example
     cp install.sh /opt/mybackup/install.sh
   • For ITX Design Server versions 11.0.0.0, 11.0.1.1 and 11.0.2.0:
     Create the backup of install script
     cp install <backup_location>/install
For example
     cp install /opt/mybackup/install
3. Update the installation script
   
   • For ITX Design Server versions 10.1.0.2, 10.1.1.1 and 10.1.2.1:
     
     1. Edit the install.sh script using vim or another editor
        vi install.sh

     2. Search for the text: $TX_MONGO_DOCKER_IMAGE
     3. Modify the line to include the --networkMessageCompressors snappy flag
        Before change:
        $TX_MONGO_DOCKER_IMAGE
        After change:
        $TX_MONGO_DOCKER_IMAGE --networkMessageCompressors snappy
   • For ITX Design Server versions 11.0.0.0:
     
     1. Edit the install script using vim or another editor
        vi install

     2. Search for the text: mongo:4.0.5
     3. Modify the line to include the --networkMessageCompressors snappy flag
        Before change:
        mongo:4.0.5  &>>$log_file
        After change:
        mongo:4.0.5 --networkMessageCompressors snappy  &>>$log_file
   • For ITX Design Server versions 11.0.1.1 and 11.0.2.0:
     
     1. Edit the install script using vim or another editor
        vi install

     2. Search for the text: docker.io/mongo:4.0.5
     3. Modify the line to include the --networkMessageCompressors snappy flag
        Before change:
        docker.io/mongo:4.0.5  &>>$log_file
        After change:
        docker.io/mongo:4.0.5 --networkMessageCompressors snappy  &>>$log_file
4. Stop ITX
   ./ITX stop
5. Remove existing MongoDB container
   
   1. List all stopped ITX containers
      docker ps -a

   2. Delete the MongoDB container
      docker rm tx-server-mongo
   3. Verify the container has been deleted
      docker ps -a
6. Run ITX installation script
   
   • For ITX Design Server versions 10.1.0.2, 10.1.1.1 and 10.1.2.1
     ./install.sh
   • For ITX Design Server versions 11.0.0.0, 11.0.1.1 and 11.0.2.0
     ./ITX install
   This step will reinstall MongoDB using the modified install script
7. Start ITX
   
   • For ITX Design Server versions 10.1.0.2, 10.1.1.1 and 10.1.2.1
     ./start.sh
   • For ITX Design Server versions 11.0.0.0, 11.0.1.1 and 11.0.2.0
     ./ITX start
8. Verify ITX has started
   
   1. Execute the following two commands:
      docker exec tx-server-mongo ps -ef
docker exec tx-server-mongo mongo --quiet --eval "db.serverStatus().network.compression"
   2. Compare the output of these commands with the output saved in the Prerequisites section.
      Expected results:
      
      • The docker exec tx-server-mongo ps -ef output should contain the text: mongod --networkMessageCompressors snappy --bind_ip_all
      • The compression status output may contain the text: snappy
      • The compression status output should not contain the text: zlib

Workaround for ITX Native Installations

For a native ITX installation, the client is responsible for owning, hosting, and administering the MongoDB server. Consequently, the client is responsible for patching the MongoDB server and applying any necessary workarounds.

As a workaround to resolve the issue, customers must disable zlib compression in the affected MongoDB server versions listed in the vulnerability details section. By default, MongoDB often enables snappy and zlib. Following steps will disable zlib and prioritize the Snappy:

1. Before making changes, run the following command in the MongoDB shell (mongosh or mongo) to check enabled compressors:
   db.serverStatus().network.compression
   This will initially show all the compressors enabled (snappy and zlib).
2. Backup your database and logs
   Always perform a backup before modifying configuration files. Use mongodump to create a copy of your databases.
   mongodump --out /path/to/backup/directory
3. Modify the configuration file
   
   1. Locate your MongoDB configuration file (typically mongod.conf)
      
      • Linux: Usually found in /etc/mongod.conf
      • Windows: Usually found in C:\Program Files\MongoDB\Server\<version>\bin\mongod.cfg
   2. Edit the MongoDB configuration file to include the compression settings under the net section, excluding zlib
      net:
  port: 27017
  bindIp: 127.0.0.1
  compression:
    compressors: snappy
4. Restart the Service
   For the changes to take effect, you must restart the MongoDB daemon.
   
   • Linux (systemd): sudo systemctl restart mongod
   • Windows: Open Services.msc, find "MongoDB Server", and click Restart.
5. Run the following command to confirm that zlib has been successfully removed from the list of enabled compressors
   db.serverStatus().network.compression
   Expected output
   {
   “snappy”: {
“compressor”: { 
       “bytesIn”: NumberLong(0), 
       “bytesOut”: NumberLong(0) 
},
“decompressor”: { 
       “bytesIn”: NumberLong(0), 
       “bytesOut”: NumberLong(0)
      }
  }
}
   The output should now only list snappy. If zlib is missing, the configuration was applied correctly.

Note for ITX MongoDB adapter users

The MongoDB adapter allows compression to be configured within the HOST property (-H {hostname | MongoDB_URI}). To mitigate this critical vulnerability, users must avoid using zlib compression if compression is configured within the HOST property for the MongoDB server versions listed in the vulnerability details section.

For example:
mongodb://localhost:27017/?compressors=zstd,snappy

Note on MongoDB compression support

MongoDB supports network message compression algorithms: zstd (v4.2+), and snappy and zlib (v4.0+). To comply with security requirements and mitigate MongoBleed security vulnerability, zlib must be explicitly excluded from supported compressors unless a fixed MongoDB server version is deployed.