PatchTheCVEapi gateway vulnerabilities and fixes
Recent CVEs affecting api gateway, with upgrade or downgrade steps. 11 tracked.
Also searched as: apigateway.
api gateway has 11 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 9. Most recent: 2020-12-08. Highest priority: CVE-2018-1000613 (score 62/100).
- CVE-2020-11979 HIGH 7.5 DOWNGRADE UPGRADE As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so tha
- CVE-2018-5407 MEDIUM 4.7 MITIGATE MITIGATE Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timi
- CVE-2020-1971 MEDIUM 5.9 UPGRADE MITIGATE The X.509 GeneralName type is a generic type for representing different types of names
- CVE-2019-17566 HIGH 7.5 UPGRADE DOWNGRADE Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:h
- CVE-2019-15631 CRITICAL 9.8 UPGRADE UPGRADE Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31,
- CVE-2019-15630 HIGH 7.5 MITIGATE UPGRADE Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 a
- CVE-2018-1000613 CRITICAL 9.8 UPGRADE MITIGATE Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.
- CVE-2018-1000180 HIGH 7.5 UPGRADE UPGRADE Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to
- CVE-2017-3601 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle API Gateway component of Oracle Fusion Middleware (subcomponent: Oracle API Gatewa
- CVE-2016-3118 MEDIUM 6.5 DOWNGRADE CRLF injection vulnerability in CA API Gateway (formerly Layer7 API Gateway) 7.1 before 7.1.04, 8.0 through 8.
- CVE-2015-3195 MEDIUM 5.3 UPGRADE DOWNGRADE The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t,
FAQ
How do I fix api gateway vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is api gateway being exploited right now?
None of the tracked api gateway CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which api gateway CVE should I patch first?
CVE-2018-1000613 currently ranks highest (62/100): Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1..