Use of a broken or risky cryptographic algorithm in IBM DB2 - CVE-2018-1428

 

Use of a broken or risky cryptographic algorithm in IBM DB2 - CVE-2018-1428

Published: May 1, 2018


Vulnerability identifier: #VU12309
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1428
CWE-ID: CWE-327
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to IBM GSKit uses weaker than expected cryptographic algorithms. A local attacker can gain access to potentially sensitive information.

Affected software

IBM DB2
Planning Analytics Local
IBM Cognos Analytics
IBM Algo One Core
IBM Cognos Controller
Security Network Protection
IBM MQ
Tivoli Network Manager IP Edition

How to mitigate CVE-2018-1428

Install update from vendor's website.

IBM Cognos Analytics - update to 11.0.13
Tivoli Network Manager IP Edition - addressed in versions 3.9.0.132, 4.1.1.49, 4.2.0.5

External References

Related Security Bulletins