Use of a broken or risky cryptographic algorithm in IBM DB2 - CVE-2018-1428
Published: May 1, 2018
Vulnerability identifier: #VU12309
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1428
CWE-ID: CWE-327
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local unauthenticated attacker to obtain potentially sensitive information on the target system.
The weakness exists due to IBM GSKit uses weaker than expected cryptographic algorithms. A local attacker can gain access to potentially sensitive information.
The weakness exists due to IBM GSKit uses weaker than expected cryptographic algorithms. A local attacker can gain access to potentially sensitive information.
Affected software
IBM DB2
Planning Analytics Local
IBM Cognos Analytics
IBM Algo One Core
IBM Cognos Controller
Security Network Protection
IBM MQ
Tivoli Network Manager IP Edition
Planning Analytics Local
IBM Cognos Analytics
IBM Algo One Core
IBM Cognos Controller
Security Network Protection
IBM MQ
Tivoli Network Manager IP Edition
How to mitigate CVE-2018-1428
Install update from vendor's website.
IBM Cognos Analytics - update to 11.0.13
Tivoli Network Manager IP Edition - addressed in versions 3.9.0.132, 4.1.1.49, 4.2.0.5
Tivoli Network Manager IP Edition - addressed in versions 3.9.0.132, 4.1.1.49, 4.2.0.5
External References
Related Security Bulletins
- Multiple vulnerabilities in IBM Cognos Controller
- Multiple vulnerabilities in IBM Security Network Protection
- Multiple vulnerabilities in IBM MQ
- Multiple vulnerabilities in IBM Algo One Core
- Multiple vulnerabilities in IBM Planning Analytics Local
- Multiple vulnerabilities in IBM Cognos Analytics
- Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition