Vulnerability Name:

CVE-2021-22931 (CCN-207230)

Assigned:2021-08-11
Published:2021-08-11
Updated:2022-08-12
Summary:Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
4.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
5.0 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
4.4 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-22931

Source: CONFIRM
Type: Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: XF
Type: UNKNOWN
nodejs-cve202122931-weak-security(207230)

Source: MISC
Type: Exploit, Issue Tracking, Third Party Advisory
https://hackerone.com/reports/1178337

Source: CCN
Type: Node.js Blog, 2021-08-11
Node v16.6.2 (Current)

Source: MISC
Type: Patch, Vendor Advisory
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210923-0001/

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20211022-0003/

Source: CCN
Type: IBM Security Bulletin 6492199 (Watson Discovery)
IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Source: CCN
Type: IBM Security Bulletin 6493269 (Business Automation Workflow)
Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM)

Source: CCN
Type: IBM Security Bulletin 6493863 (Cloud Transformation Advisor)
IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6495861 (Event Streams)
IBM Event Streams UI affected by multiple node package vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6507025 (App Connect Enterprise Certified Container)
IBM App Connect Enterprise Certified Container may be vulnerable to domain hijacking due to CVE-2021-22931

Source: CCN
Type: IBM Security Bulletin 6507095 (Planning Analytics)
IBM Planning Analytics Workspace is affected by security vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6507409 (Voice Gateway)
Multiple security vulnerabilities in Node.js affect IBM Voice Gateway

Source: CCN
Type: IBM Security Bulletin 6507665 (Cloud Pak for Integration)
IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6509088 (InfoSphere Information Server)
IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js

Source: CCN
Type: IBM Security Bulletin 6514803 (Cloud Pak for Multicloud Management)
A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services

Source: CCN
Type: IBM Security Bulletin 6524930 (Spectrum Control)
Vulnerabilities in Node.js, IBM WebSphere Application Server Liberty, and OpenSSL affect IBM Spectrum Control

Source: CCN
Type: IBM Security Bulletin 6525034 (Spectrum Protect Plus)
Vulnerabilities in Node.js, Color-String, and PostgreSQL affect IBM Spectrum Protect Plus

Source: CCN
Type: IBM Security Bulletin 6541298 (Cloud Pak for Automation)
Multiple security vulnerabilities fixed in Cloud Pak for Automation components

Source: CCN
Type: IBM Security Bulletin 6551876 (Cloud Pak for Security)
Cloud Pak for Security uses packages that are vulnerable to multiple CVEs

Source: CCN
Type: IBM Security Bulletin 6570277 (Security Verify Governance)
IBM has announced a release for IBM Security Verify Governance in response to a security vulnerability (CVE-2021-22931)

Source: CCN
Type: IBM Security Bulletin 6570957 (Cognos Analytics)
IBM Cognos Analytics has addressed multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6573633 (QRadar Use Case Manager)
IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6589143 (DataPower Gateway)
IBM DataPower Gateway potentially vulnerable to DNS spoofing

Source: CCN
Type: IBM Security Bulletin 6590981 (QRadar Data Synchronization App)
IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6855777 (Engineering Requirements Quality Assistant On-Premises)
There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises (CVE-2021-22939, CVE-2021-22931, CVE-2020-7598)

Source: CCN
Type: Oracle CPUJan2022
Oracle Critical Patch Update Advisory - January 2022

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html

Source: CCN
Type: Oracle CPUJul2022
Oracle Critical Patch Update Advisory - July 2022

Source: N/A
Type: Third Party Advisory
N/A

Source: CCN
Type: Oracle CPUOct2021
Oracle Critical Patch Update Advisory - October 2021

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version >= 16.0.0 and < 16.6.2)
  • OR cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version >= 14.0.0 and <= 14.14.0)
  • OR cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 12.13.0 and < 12.22.5)
  • OR cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version >= 12.0.0 and <= 12.12.0)
  • OR cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 14.15.0 and < 14.17.5)

    • Configuration 2:
  • cpe:/a:netapp:snapcenter:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • OR cpe:/a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
  • OR cpe:/a:netapp:nextgen_api:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:mysql_cluster:*:*:*:*:*:*:*:* (Version <= 8.0.26)

    • Configuration 4:
  • cpe:/a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* (Version < 1.0.1.1)

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:nodejs:node.js:12:*:*:*:*:*:*:*
  • OR cpe:/a:nodejs:node.js:14.0:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:business_process_manager:8.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:watson_discovery:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.4:*:standard:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.5:*:standard:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:datapower_gateway:10.0.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:watson_discovery:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:21.0.2:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:datapower_gateway:10.0.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:datapower_gateway:10.0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:datapower_gateway:10.0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_verify_governance:10.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:engineering_requirements_quality_assistant_on-premises:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8162
    P
    		Security update for terraform-provider-helm (Important)
    2023-06-21
    oval:org.opensuse.security:def:8186
    P
    		Security update for cloud-init (Important) (in QA)
    2023-06-12
    oval:org.opensuse.security:def:8165
    P
    		Security update for mariadb (Low)
    2023-06-09
    oval:org.opensuse.security:def:8184
    P
    		Security update for google-cloud-sap-agent (Important)
    2023-06-07
    oval:org.opensuse.security:def:8163
    P
    		Security update for tiff (Moderate)
    2023-05-31
    oval:org.opensuse.security:def:3542
    P
    		lcms2-2.7-9.7.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95172
    P
    		nodejs16-16.14.1-150400.1.26 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:6165
    P
    		Security update for tiff (Important)
    2022-02-18
    oval:org.opensuse.security:def:111072
    P
    		Security update for nodejs14 (Important)
    2021-09-28
    oval:com.redhat.rhsa:def:20213666
    P
    		RHSA-2021:3666: nodejs:14 security and bug fix update (Important)
    2021-09-27
    oval:org.opensuse.security:def:111727
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:1709
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:96130
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:69275
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:118582
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:102269
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:69254
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:109486
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:102820
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:49452
    P
    		Security update for nodejs14 (Important)
    2021-09-22
    oval:org.opensuse.security:def:20981
    P
    		Security update for nodejs14 (Important)
    2021-09-22
    oval:com.redhat.rhsa:def:20213623
    P
    		RHSA-2021:3623: nodejs:12 security and bug fix update (Important)
    2021-09-21
    oval:org.opensuse.security:def:111050
    P
    		Security update for nodejs10 (Moderate)
    2021-09-07
    oval:org.opensuse.security:def:118580
    P
    		Security update for nodejs10 (Moderate)
    2021-09-03
    oval:org.opensuse.security:def:69252
    P
    		Security update for nodejs10 (Moderate)
    2021-09-03
    oval:org.opensuse.security:def:109484
    P
    		Security update for nodejs10 (Moderate)
    2021-09-03
    oval:org.opensuse.security:def:102818
    P
    		Security update for nodejs10 (Moderate)
    2021-09-03
    oval:org.opensuse.security:def:76322
    P
    		Security update for nodejs10 (Moderate)
    2021-09-03
    oval:org.opensuse.security:def:111704
    P
    		Security update for nodejs10 (Moderate)
    2021-09-03
    oval:org.opensuse.security:def:96128
    P
    		Security update for nodejs10 (Moderate)
    2021-09-03
    oval:org.opensuse.security:def:67254
    P
    		Security update for nodejs10 (Moderate)
    2021-09-03
    oval:org.opensuse.security:def:111040
    P
    		Security update for nodejs12 (Important)
    2021-08-31
    oval:org.opensuse.security:def:69251
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:102267
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:109483
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:102817
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:111695
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:96127
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:1707
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:118579
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:69273
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:49448
    P
    		Security update for nodejs10 (Moderate)
    2021-08-24
    oval:org.opensuse.security:def:20977
    P
    		Security update for nodejs10 (Moderate)
    2021-08-24
    oval:org.opensuse.security:def:49449
    P
    		Security update for nodejs12 (Important)
    2021-08-24
    oval:org.opensuse.security:def:20978
    P
    		Security update for nodejs12 (Important)
    2021-08-24
    BACK
    nodejs node.js *
    nodejs node.js *
    nodejs node.js *
    nodejs node.js *
    nodejs node.js *
    netapp snapcenter -
    netapp oncommand workflow automation -
    netapp oncommand insight -
    netapp active iq unified manager -
    netapp active iq unified manager -
    netapp nextgen api -
    oracle peoplesoft enterprise peopletools 8.57
    oracle peoplesoft enterprise peopletools 8.58
    oracle peoplesoft enterprise peopletools 8.59
    oracle graalvm 20.3.3
    oracle graalvm 21.2.0
    oracle mysql cluster *
    siemens sinec infrastructure network services *
    nodejs node.js 12
    nodejs node.js 14.0
    ibm business process manager 8.5
    ibm business process manager 8.6
    ibm infosphere information server 11.7
    ibm business automation workflow 18.0.0.0
    ibm business automation workflow 18.0.0.1
    oracle peoplesoft enterprise peopletools 8.57
    ibm business automation workflow 18.0.0.2
    ibm business automation workflow 19.0.0.1
    ibm business automation workflow 19.0.0.2
    ibm spectrum control 5.3.1
    ibm spectrum control 5.3.2
    ibm spectrum control 5.3.3
    ibm spectrum control 5.3.0.1
    ibm watson discovery 2.0.0
    ibm business automation workflow 19.0.0.3
    ibm event streams 2019.4.1
    ibm event streams 2019.4.2
    ibm event streams 10.0.0
    ibm spectrum control 5.3.4
    ibm spectrum control 5.3.5
    ibm spectrum control 5.3.6
    ibm spectrum control 5.3.7
    ibm app connect enterprise certified container 1.0.0
    ibm app connect enterprise certified container 1.0.1
    ibm app connect enterprise certified container 1.0.2
    ibm app connect enterprise certified container 1.0.3
    ibm app connect enterprise certified container 1.0.4
    ibm business automation workflow 20.0.0.1
    ibm event streams 2019.4.3
    ibm event streams 10.1.0
    ibm business automation workflow 20.0.0.2
    ibm datapower gateway 10.0.1.0
    ibm spectrum control 5.4.1
    ibm voice gateway 1.0.7
    ibm watson discovery 2.2.1
    ibm event streams 10.2.0
    ibm cloud pak for automation 21.0.1
    ibm planning analytics 2.0
    ibm cloud pak for automation 21.0.2 -
    ibm datapower gateway 10.0.1.4
    ibm datapower gateway 10.0.2.0
    ibm business automation workflow 21.0.2
    ibm cloud pak for security 1.7.2.0
    ibm event streams 10.3.0
    ibm event streams 10.3.1
    ibm cognos analytics 11.2.0
    ibm cognos analytics 11.1.7
    ibm planning analytics 2.0
    ibm cognos analytics 11.2.1
    ibm datapower gateway 10.0.3.0
    ibm security verify governance 10.0.1
    ibm engineering requirements quality assistant on-premises -