Improper Certificate Validation in Spring AMQP - CVE-2018-11087

Vulnerability identifier: #VU84551

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-11087

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to lack of hostname validation. A remote attacker that has the ability to intercept traffic would be able to view data in transit.

Spring AMQP
IBM Qradar SIEM
Storage Protect Client
Storage Protect for Space Management
Storage Protect for Virtual Environments: Data Protection for VMware

Install updates from vendor's website.

Spring AMQP - addressed in versions 1.7.10, 2.0.6
Storage Protect Client - update to 8.1.20.0
Storage Protect for Space Management - update to 8.1.20.0
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.20.0

• https://pivotal.io/security/cve-2018-11087

• Improper certificate validation in IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management
• Improper certificate validation in IBM QRadar SIEM