IBM API Connect Denial of Service

Summary

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

Remediation

1. Inventory every IBM API Connect deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://www.ibm.com/support/pages/node/7291753
• Patchhttps://www.ibm.com/support/pages/node/7292434