IBM Security Bulletin: IBM API Connect is affected by Node.js tough-cookie module vulnerability to a denial of service (CVE-2016-1000232)

API Connect has addressed the following vulnerability. Node.js tough-cookie module is vulnerable to a denial of service, caused by a regular expression error. By using a sufficiently large HTTP request Cookie header, a remote attacker could exploit this vulnerability to cause the application to consume an overly large amount of CPU resources.

CVE(s): CVE-2016-1000232

Affected product(s) and affected version(s):

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg22013088
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/119038

The post IBM Security Bulletin: IBM API Connect is affected by Node.js tough-cookie module vulnerability to a denial of service (CVE-2016-1000232) appeared first on IBM PSIRT Blog.

Affected API Connect	Affected Versions
IBM API Connect	5.0.6.0-5.0.6.5
IBM API Connect	5.0.7.0-5.0.7.2
IBM API Connect	5.0.8.0

from IBM Product Security Incident Response Team http://ift.tt/2ofgd7u