Use of a broken or risky cryptographic algorithm in IBM WebSphere Application Server Liberty - CVE-2023-50312

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU86988

Use of a broken or risky cryptographic algorithm in IBM WebSphere Application Server Liberty - CVE-2023-50312

Published: March 4, 2024


Vulnerability identifier: #VU86988
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-50312
CWE-ID: CWE-327
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an adjacent attacker to gain access to potentially sensitive information.

The vulnerability exists due to weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. An adjacent attacker can gain unauthorized access to sensitive information on the system.


Affected software

IBM WebSphere Application Server Liberty
Storage Protect Client
IBM OpenPages with Watson
IBM InfoSphere Identity Insight
PowerVM NovaLink
IBM Planning Analytics Workspace
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect Operations Center
Maximo Application Suite - Monitor Component
IBM Virtualization Engine TS7700 3948-VED
Maximo Application Suite - Predict Component
Robotic Process Automation for Cloud Pak
Business Automation Insights
Engineering Workflow Management
Log Analysis
IBM Operations Analytics Predictive Insights
Netcool Operations Insight
IBM Sterling B2B Integrator
IBM Spectrum Symphony
IBM Transformation Extender Advanced
CICS Transaction Gateway
IBM Cloud Application Business Insights
IBM Process Mining
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Tivoli Netcool Impact
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Common Licensing
IBM TXSeries for Multiplatforms
IBM Security Verify Governance - Containerized Identity Manager
IBM Security Verify Governance
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Jazz Foundation
IBM CICS TX Advanced
IBM CICS TX Standard
IBM i
IBM Tivoli Application Dependency Discovery Manager
IBM Cognos Controller
IBM License Metric Tool
Voice Gateway
Planning Analytics Local
IBM Cognos Analytics
IBM Cloud Pak System
IBM Spectrum Scale
IBM Storage Scale System
Virtualization Engine TS7700 3957-VED
IBM Watson Explorer Foundational Components
IBM Watson Explorer Analytical Components
IBM InfoSphere Information Server

How to mitigate CVE-2023-50312

Install updates from vendor's website.

IBM WebSphere Application Server Liberty - update to 24.0.0.3
IBM Operations Analytics Predictive Insights - update to 1.3.6.8
Netcool Operations Insight - update to 1.6.15
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Spectrum Symphony - update to 7.3.2 FP3
IBM Cognos Controller - update to 11.0.1.0.3
Voice Gateway - addressed in versions 1.0.8.11, 1.0.8.14
IBM Cloud Application Business Insights - addressed in versions 1.1.7.10, 1.1.8.5
IBM Process Mining - update to 1.15.0 IF004
Planning Analytics Local - update to 2.0.9.20
PowerVM NovaLink - addressed in versions 2.1.1-240415, 2.2.0-240415
IBM Planning Analytics Workspace - update to 2.1.4
IBM Cloud Pak System - addressed in versions 2.3.4.1, 24.0.0.6
IBM Cloud Transformation Advisor - update to 3.10.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.4
IBM Match 360 - update to 5.0.1
IBM Spectrum Scale - addressed in versions 5.1.9.3, 5.2.0.0
IBM Spectrum Control - update to 5.4.12
IBM Storage Scale System - addressed in versions 6.1.9.3, 6.2.0.0
IBM Tivoli Netcool Impact - update to 7.1.0.34
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.17
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.23.0
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.23.0
Storage Protect Operations Center - update to 8.1.23
Maximo Application Suite - Monitor Component - addressed in versions 8.10.12, 8.11.9, 9.0.0
IBM Maximo Application Suite - addressed in versions 8.10.16, 8.11.13, 9.0.1
IBM Virtualization Engine TS7700 3948-VED - addressed in versions 8.53.1.21 VTD_EXEC.903, 8.54.1.27 VTD_EXEC.904
Virtualization Engine TS7700 3957-VED - addressed in versions 8.53.1.21 VTD_EXEC.903, 8.54.1.27 VTD_EXEC.904
Maximo Application Suite - Predict Component - update to 9.0.0
IBM Common Licensing - update to 9.0.0.1
IBM TXSeries for Multiplatforms - update to 9.1.0.3
IBM License Metric Tool - update to 9.2.36
IBM Security Verify Governance - Containerized Identity Manager - update to 10.0.2
IBM Security Verify Governance - update to 10.0.2.0.3
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix26, 11.1.0.0 ifix19
IBM Watson Explorer Foundational Components - addressed in versions 11.0.2.19, 12.0.3.15
IBM Watson Explorer Analytical Components - addressed in versions 11.0.2.19, 12.0.3.15
IBM CICS TX Standard - update to 11.1.0.0 ifix19
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM Business Automation Workflow - addressed in versions 21.0.3 IF033, 23.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.32, 23.0.2.4
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
Business Automation Insights - update to 23.0.2.0.6

External References

Related Security Bulletins