Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud

Mar 17, 2020 8:00 pm EDT

Categorized: Medium Severity

Share this post:

Node.js (Update 6-February-2020) Security releases available

Affected product(s) and affected version(s):

All supported versions (10.x, and 12.x) of Node.js are vulnerable.

Through the command-line Cloud Foundry client run the following command:

 cf ssh <appname> -c “cat app/logs/staging_task.log” | grep “Installing node”
—–> Installing node 10.19.0

Alternatively, through the command-line Cloud Foundry client run the following command:

$ cf ssh <appname> -c “cat app/logs/staging_task.log” | grep “IBM SDK for Node.js”
—–> IBM SDK for Node.js Buildpack v4.2-20200227-1649

If the Buildpack version is not at least  v4.2 your application may be vulnerable.

Refer to the following reference URLs for remediation and additional vulnerability details:  
Source Bulletin: https://www.ibm.com/support/pages/node/6027946

from IBM Product Security Incident Response Team https://ift.tt/2QofoqO