Use of a broken or risky cryptographic algorithm in IBM Semeru Runtimes - CVE-2024-22361

Vulnerability identifier: #VU86329

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-22361

CWE-ID: CWE-327

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the use of weaker than expected cryptographic algorithms. A remote attacker can gain unauthorized access to sensitive information on the system.

IBM Semeru Runtimes
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
DB2 Query Management Facility
Host On-Demand
IBM SPSS Collaboration and Deployment Services
z/Transaction Processing Facility ( z/TPF)
IBM Tivoli Netcool Impact
IBM Sterling Connect:Direct FTP+
IBM Decision Optimization for Cloud Pak for Data
IBM Sterling Connect:Direct for UNIX
IBM Sterling Connect:Direct Web Services
IBM Sterling Control Center
IBM Sterling Connect:Direct File Agent
IBM Cognos Command Center
IBM App Connect Enterprise

Install updates from vendor's website.

IBM Semeru Runtimes - addressed in versions 8.0.402.0, 11.0.22.0, 17.0.10.0, 21.0.2.0
IBM Tivoli Netcool Impact - update to 7.1.0.36
Host On-Demand - update to 15.0.2
IBM Sterling Connect:Direct FTP+ - update to 1.3.0.0.26
IBM Sterling Connect:Direct File Agent - update to 1.4.0.3.4
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
IBM Sterling Connect:Direct for UNIX - addressed in versions 6.0.0.2.164, 6.1.0.4.106
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.24, 6.2.0.23, 6.3.0.7
IBM Sterling Control Center - addressed in versions 6.2.1.0.13, 6.3.1.0.2
IBM Cognos Command Center - update to 10.2.5 IF2
IBM App Connect Enterprise - update to 12.0.11.3

• https://www.ibm.com/support/pages/node/7116431
• https://exchange.xforce.ibmcloud.com/vulnerabilities/281222

• Multiple vulnerabilities in IBM Semeru Runtime
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in IBM CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in IBM Sterling Connect:Direct File Agent
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM z/Transaction Processing Facility
• Multiple vulnerabilities in IBM Decision Optimization for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Sterling Connect:Direct FTP+
• Multiple vulnerabilities in IBM Sterling Connect:Direct for UNIX
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM Host On-Demand
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Sterling Control Center
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Db2 Query Management Facility
• Multiple vulnerabilities in IBM Tivoli Netcool Impact