Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-32342 (GCVE-0-2023-32342)
Vulnerability from cvelistv5
- 208 Information Exposure Through Timing Discrepancy
URL | Tags | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T15:10:24.962Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "vdb-entry", "x_transferred" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-32342", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-01-09T21:10:47.537164Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-01-09T21:11:08.128Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "GSKit", "vendor": "IBM", "versions": [ { "status": "affected", "version": " " } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828." } ], "value": "IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "description": "208 Information Exposure Through Timing Discrepancy", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2023-05-30T21:03:25.816Z", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm" }, "references": [ { "tags": [ "vdb-entry" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828" } ], "source": { "discovery": "UNKNOWN" }, "title": "IBM GSKit information disclosure", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2023-32342", "datePublished": "2023-05-30T21:03:25.816Z", "dateReserved": "2023-05-08T18:32:52.654Z", "dateUpdated": "2025-01-09T21:11:08.128Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-32342\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2023-05-30T22:15:10.677\",\"lastModified\":\"2024-11-21T08:03:09.113\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-203\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0.0\",\"versionEndExcluding\":\"8.5.5.24\",\"matchCriteriaId\":\"59E31948-A20E-4B41-A65C-67C0F64611F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0.0\",\"versionEndExcluding\":\"9.0.5.16\",\"matchCriteriaId\":\"A31D0CD4-3CB3-4BD9-A97E-DC9CF053A6A8\"}]}]}],\"references\":[{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/255828\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/255828\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"VDB Entry\",\"Vendor Advisory\"]}]}}", "vulnrichment": { "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/255828\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T15:10:24.962Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-32342\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-09T21:10:47.537164Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-09T21:11:02.497Z\"}}], \"cna\": {\"title\": \"IBM GSKit information disclosure\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"IBM\", \"product\": \"GSKit\", \"versions\": [{\"status\": \"affected\", \"version\": \" \"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/255828\", \"tags\": [\"vdb-entry\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"208 Information Exposure Through Timing Discrepancy\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2023-05-30T21:03:25.816Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2023-32342\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-09T21:11:08.128Z\", \"dateReserved\": \"2023-05-08T18:32:52.654Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2023-05-30T21:03:25.816Z\", \"assignerShortName\": \"ibm\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1" } } }
WID-SEC-W-2023-2823
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM DB2 ausnutzen, um Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2823 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2823.json" }, { "category": "self", "summary": "WID-SEC-2023-2823 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2823" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-11-05", "url": "https://www.ibm.com/support/pages/node/7066501" } ], "source_lang": "en-US", "title": "IBM DB2: Schwachstelle erm\u00f6glicht Offenlegung von Informationen", "tracking": { "current_release_date": "2023-11-05T23:00:00.000+00:00", "generator": { "date": "2024-08-15T18:01:03.596+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-2823", "initial_release_date": "2023-11-05T23:00:00.000+00:00", "revision_history": [ { "date": "2023-11-05T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM DB2 \u003c 10.5 FP11", "product": { "name": "IBM DB2 \u003c 10.5 FP11", "product_id": "T030924", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:10.5_fp11" } } }, { "category": "product_name", "name": "IBM DB2 \u003c 11.1.4 FP7", "product": { "name": "IBM DB2 \u003c 11.1.4 FP7", "product_id": "T030925", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:11.1.4_fp7" } } }, { "category": "product_name", "name": "IBM DB2 \u003c 11.5.0", "product": { "name": "IBM DB2 \u003c 11.5.0", "product_id": "T030926", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:11.5.0" } } } ], "category": "product_name", "name": "DB2" } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-32342", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in IBM DB2. Dieser Fehler besteht in der GSKit-Komponente aufgrund eines zeitbasierten Seitenkanals in der RSA-Entschl\u00fcsselungsimplementierung. Durch das Senden einer \u00fcberm\u00e4\u00dfig gro\u00dfen Anzahl von Testmeldungen zur Entschl\u00fcsselung kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen." } ], "release_date": "2023-11-05T23:00:00.000+00:00", "title": "CVE-2023-32342" } ] }
WID-SEC-W-2023-1302
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Der IBM HTTP Server ist ein Webserver auf Apache Basis.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle im IBM HTTP Server ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1302 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1302.json" }, { "category": "self", "summary": "WID-SEC-2023-1302 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1302" }, { "category": "external", "summary": "IBM Security Bulletin vom 2023-05-24", "url": "https://www.ibm.com/support/pages/node/6998037" }, { "category": "external", "summary": "IBM Security Bulletin", "url": "https://www.ibm.com/support/pages/node/7001289" }, { "category": "external", "summary": "IBM Security Bulletin 7007741 vom 2023-06-29", "url": "https://www.ibm.com/support/pages/node/7007741" }, { "category": "external", "summary": "IBM Security Bulletin 7007429 vom 2023-06-29", "url": "https://www.ibm.com/support/pages/node/7007429" }, { "category": "external", "summary": "IBM Security Bulletin 7014259 vom 2023-07-24", "url": "https://www.ibm.com/support/pages/node/7014259" }, { "category": "external", "summary": "IBM Security Bulletin 7014651 vom 2023-07-26", "url": "https://www.ibm.com/support/pages/node/7014651" }, { "category": "external", "summary": "IBM Security Bulletin 7027925 vom 2023-09-01", "url": "https://www.ibm.com/support/pages/node/7027925" }, { "category": "external", "summary": "HCL Security Bulletin vom 2024-05-01", "url": "https://support.hcltechsw.com/community?id=community_blog\u0026sys_id=72d68adf1bf5c29c574121f7ec4bcbdb" }, { "category": "external", "summary": "HCL Article KB0112204 vom 2024-05-25", "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0112204" }, { "category": "external", "summary": "IBM Security Bulletin 7160975 vom 2024-07-30", "url": "https://www.ibm.com/support/pages/node/7160975" } ], "source_lang": "en-US", "title": "IBM HTTP Server: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen", "tracking": { "current_release_date": "2024-07-30T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:51:25.747+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-1302", "initial_release_date": "2023-05-24T22:00:00.000+00:00", "revision_history": [ { "date": "2023-05-24T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-06-05T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-06-28T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-07-24T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-07-25T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-08-31T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-05-01T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates aufgenommen" }, { "date": "2024-05-26T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von HCL aufgenommen" }, { "date": "2024-07-30T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "9" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "HCL Commerce", "product": { "name": "HCL Commerce", "product_id": "T019293", "product_identification_helper": { "cpe": "cpe:/a:hcltechsw:commerce:-" } } }, { "category": "product_version_range", "name": "\u003c9.0.1.21", "product": { "name": "HCL Commerce \u003c9.0.1.21", "product_id": "T035061" } }, { "category": "product_version_range", "name": "\u003c9.1.13", "product": { "name": "HCL Commerce \u003c9.1.13", "product_id": "T035062" } } ], "category": "product_name", "name": "Commerce" } ], "category": "vendor", "name": "HCL" }, { "branches": [ { "category": "product_name", "name": "IBM Business Automation Workflow", "product": { "name": "IBM Business Automation Workflow", "product_id": "T019704", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:-" } } }, { "branches": [ { "category": "product_version", "name": "8.5", "product": { "name": "IBM HTTP Server 8.5", "product_id": "T001650", "product_identification_helper": { "cpe": "cpe:/a:ibm:http_server:8.5" } } }, { "category": "product_version", "name": "9", "product": { "name": "IBM HTTP Server 9.0", "product_id": "T008162", "product_identification_helper": { "cpe": "cpe:/a:ibm:http_server:9.0" } } } ], "category": "product_name", "name": "HTTP Server" }, { "category": "product_name", "name": "IBM Informix", "product": { "name": "IBM Informix", "product_id": "5121", "product_identification_helper": { "cpe": "cpe:/a:ibm:informix:-" } } }, { "branches": [ { "category": "product_name", "name": "IBM MQ", "product": { "name": "IBM MQ", "product_id": "T021398", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:-" } } }, { "category": "product_version", "name": "appliance", "product": { "name": "IBM MQ appliance", "product_id": "T025711", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:appliance" } } } ], "category": "product_name", "name": "MQ" }, { "branches": [ { "category": "product_version", "name": "9.0.1", "product": { "name": "IBM Rational ClearQuest 9.0.1", "product_id": "433842", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearquest:9.0.1" } } }, { "category": "product_version", "name": "9.0.2", "product": { "name": "IBM Rational ClearQuest 9.0.2", "product_id": "T021437", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearquest:9.0.2" } } }, { "category": "product_version", "name": "9.1", "product": { "name": "IBM Rational ClearQuest 9.1", "product_id": "T021438", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearquest:9.1" } } }, { "category": "product_version", "name": "10", "product": { "name": "IBM Rational ClearQuest 10.0", "product_id": "T027869", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearquest:10.0" } } } ], "category": "product_name", "name": "Rational ClearQuest" }, { "category": "product_name", "name": "IBM Security Verify Access", "product": { "name": "IBM Security Verify Access", "product_id": "T026175", "product_identification_helper": { "cpe": "cpe:/a:ibm:security_verify_access:10.0.x" } } }, { "branches": [ { "category": "product_version", "name": "6.3.0.7", "product": { "name": "IBM Tivoli Monitoring 6.3.0.7", "product_id": "342008", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_monitoring:6.3.0.7" } } } ], "category": "product_name", "name": "Tivoli Monitoring" } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-32342", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle im IBM HTTP Server. Unter bestimmten Umst\u00e4nden kommt es zu einem zeitbasierten Seitenkanal in der RSA-Entschl\u00fcsselungsimplementierung. Wenn eine gro\u00dfe Anzahl von Versuchsnachrichten f\u00fcr die Entschl\u00fcsselung an das System gesendet wird, k\u00f6nnen aufgrund der Verarbeitungszeit R\u00fcckschl\u00fcsse auf den privaten RSA-Schl\u00fcssel gezogen werden. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um die Kryptographie zu umgehen." } ], "product_status": { "known_affected": [ "433842", "T026175", "5121", "T019293", "T027869", "T021438", "T025711", "T035062", "T019704", "T021437", "T035061", "T001650", "T008162", "342008", "T021398" ] }, "release_date": "2023-05-24T22:00:00.000+00:00", "title": "CVE-2023-32342" } ] }
wid-sec-w-2023-2823
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM DB2 ausnutzen, um Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2823 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2823.json" }, { "category": "self", "summary": "WID-SEC-2023-2823 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2823" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-11-05", "url": "https://www.ibm.com/support/pages/node/7066501" } ], "source_lang": "en-US", "title": "IBM DB2: Schwachstelle erm\u00f6glicht Offenlegung von Informationen", "tracking": { "current_release_date": "2023-11-05T23:00:00.000+00:00", "generator": { "date": "2024-08-15T18:01:03.596+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-2823", "initial_release_date": "2023-11-05T23:00:00.000+00:00", "revision_history": [ { "date": "2023-11-05T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM DB2 \u003c 10.5 FP11", "product": { "name": "IBM DB2 \u003c 10.5 FP11", "product_id": "T030924", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:10.5_fp11" } } }, { "category": "product_name", "name": "IBM DB2 \u003c 11.1.4 FP7", "product": { "name": "IBM DB2 \u003c 11.1.4 FP7", "product_id": "T030925", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:11.1.4_fp7" } } }, { "category": "product_name", "name": "IBM DB2 \u003c 11.5.0", "product": { "name": "IBM DB2 \u003c 11.5.0", "product_id": "T030926", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:11.5.0" } } } ], "category": "product_name", "name": "DB2" } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-32342", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in IBM DB2. Dieser Fehler besteht in der GSKit-Komponente aufgrund eines zeitbasierten Seitenkanals in der RSA-Entschl\u00fcsselungsimplementierung. Durch das Senden einer \u00fcberm\u00e4\u00dfig gro\u00dfen Anzahl von Testmeldungen zur Entschl\u00fcsselung kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen." } ], "release_date": "2023-11-05T23:00:00.000+00:00", "title": "CVE-2023-32342" } ] }
wid-sec-w-2023-1302
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Der IBM HTTP Server ist ein Webserver auf Apache Basis.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle im IBM HTTP Server ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1302 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1302.json" }, { "category": "self", "summary": "WID-SEC-2023-1302 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1302" }, { "category": "external", "summary": "IBM Security Bulletin vom 2023-05-24", "url": "https://www.ibm.com/support/pages/node/6998037" }, { "category": "external", "summary": "IBM Security Bulletin", "url": "https://www.ibm.com/support/pages/node/7001289" }, { "category": "external", "summary": "IBM Security Bulletin 7007741 vom 2023-06-29", "url": "https://www.ibm.com/support/pages/node/7007741" }, { "category": "external", "summary": "IBM Security Bulletin 7007429 vom 2023-06-29", "url": "https://www.ibm.com/support/pages/node/7007429" }, { "category": "external", "summary": "IBM Security Bulletin 7014259 vom 2023-07-24", "url": "https://www.ibm.com/support/pages/node/7014259" }, { "category": "external", "summary": "IBM Security Bulletin 7014651 vom 2023-07-26", "url": "https://www.ibm.com/support/pages/node/7014651" }, { "category": "external", "summary": "IBM Security Bulletin 7027925 vom 2023-09-01", "url": "https://www.ibm.com/support/pages/node/7027925" }, { "category": "external", "summary": "HCL Security Bulletin vom 2024-05-01", "url": "https://support.hcltechsw.com/community?id=community_blog\u0026sys_id=72d68adf1bf5c29c574121f7ec4bcbdb" }, { "category": "external", "summary": "HCL Article KB0112204 vom 2024-05-25", "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0112204" }, { "category": "external", "summary": "IBM Security Bulletin 7160975 vom 2024-07-30", "url": "https://www.ibm.com/support/pages/node/7160975" } ], "source_lang": "en-US", "title": "IBM HTTP Server: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen", "tracking": { "current_release_date": "2024-07-30T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:51:25.747+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-1302", "initial_release_date": "2023-05-24T22:00:00.000+00:00", "revision_history": [ { "date": "2023-05-24T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-06-05T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-06-28T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-07-24T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-07-25T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-08-31T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-05-01T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates aufgenommen" }, { "date": "2024-05-26T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von HCL aufgenommen" }, { "date": "2024-07-30T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "9" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "HCL Commerce", "product": { "name": "HCL Commerce", "product_id": "T019293", "product_identification_helper": { "cpe": "cpe:/a:hcltechsw:commerce:-" } } }, { "category": "product_version_range", "name": "\u003c9.0.1.21", "product": { "name": "HCL Commerce \u003c9.0.1.21", "product_id": "T035061" } }, { "category": "product_version_range", "name": "\u003c9.1.13", "product": { "name": "HCL Commerce \u003c9.1.13", "product_id": "T035062" } } ], "category": "product_name", "name": "Commerce" } ], "category": "vendor", "name": "HCL" }, { "branches": [ { "category": "product_name", "name": "IBM Business Automation Workflow", "product": { "name": "IBM Business Automation Workflow", "product_id": "T019704", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:-" } } }, { "branches": [ { "category": "product_version", "name": "8.5", "product": { "name": "IBM HTTP Server 8.5", "product_id": "T001650", "product_identification_helper": { "cpe": "cpe:/a:ibm:http_server:8.5" } } }, { "category": "product_version", "name": "9", "product": { "name": "IBM HTTP Server 9.0", "product_id": "T008162", "product_identification_helper": { "cpe": "cpe:/a:ibm:http_server:9.0" } } } ], "category": "product_name", "name": "HTTP Server" }, { "category": "product_name", "name": "IBM Informix", "product": { "name": "IBM Informix", "product_id": "5121", "product_identification_helper": { "cpe": "cpe:/a:ibm:informix:-" } } }, { "branches": [ { "category": "product_name", "name": "IBM MQ", "product": { "name": "IBM MQ", "product_id": "T021398", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:-" } } }, { "category": "product_version", "name": "appliance", "product": { "name": "IBM MQ appliance", "product_id": "T025711", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:appliance" } } } ], "category": "product_name", "name": "MQ" }, { "branches": [ { "category": "product_version", "name": "9.0.1", "product": { "name": "IBM Rational ClearQuest 9.0.1", "product_id": "433842", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearquest:9.0.1" } } }, { "category": "product_version", "name": "9.0.2", "product": { "name": "IBM Rational ClearQuest 9.0.2", "product_id": "T021437", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearquest:9.0.2" } } }, { "category": "product_version", "name": "9.1", "product": { "name": "IBM Rational ClearQuest 9.1", "product_id": "T021438", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearquest:9.1" } } }, { "category": "product_version", "name": "10", "product": { "name": "IBM Rational ClearQuest 10.0", "product_id": "T027869", "product_identification_helper": { "cpe": "cpe:/a:ibm:rational_clearquest:10.0" } } } ], "category": "product_name", "name": "Rational ClearQuest" }, { "category": "product_name", "name": "IBM Security Verify Access", "product": { "name": "IBM Security Verify Access", "product_id": "T026175", "product_identification_helper": { "cpe": "cpe:/a:ibm:security_verify_access:10.0.x" } } }, { "branches": [ { "category": "product_version", "name": "6.3.0.7", "product": { "name": "IBM Tivoli Monitoring 6.3.0.7", "product_id": "342008", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_monitoring:6.3.0.7" } } } ], "category": "product_name", "name": "Tivoli Monitoring" } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-32342", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle im IBM HTTP Server. Unter bestimmten Umst\u00e4nden kommt es zu einem zeitbasierten Seitenkanal in der RSA-Entschl\u00fcsselungsimplementierung. Wenn eine gro\u00dfe Anzahl von Versuchsnachrichten f\u00fcr die Entschl\u00fcsselung an das System gesendet wird, k\u00f6nnen aufgrund der Verarbeitungszeit R\u00fcckschl\u00fcsse auf den privaten RSA-Schl\u00fcssel gezogen werden. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um die Kryptographie zu umgehen." } ], "product_status": { "known_affected": [ "433842", "T026175", "5121", "T019293", "T027869", "T021438", "T025711", "T035062", "T019704", "T021437", "T035061", "T001650", "T008162", "342008", "T021398" ] }, "release_date": "2023-05-24T22:00:00.000+00:00", "title": "CVE-2023-32342" } ] }
WID-SEC-W-2023-2550
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM Rational ClearQuest stellt eine L\u00f6sung zur Fehler- und \u00c4nderungsverfolgung zur Verf\u00fcgung.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Rational ClearQuest ausnutzen, um Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2550 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2550.json" }, { "category": "self", "summary": "WID-SEC-2023-2550 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2550" }, { "category": "external", "summary": "IBM Security Bulletin 7130904 vom 2024-03-08", "url": "https://www.ibm.com/support/pages/node/7130904" }, { "category": "external", "summary": "IBM Security Bulletin vom 2023-10-03", "url": "https://www.ibm.com/support/pages/node/7041679" }, { "category": "external", "summary": "IBM Security Bulletin 7149801 vom 2024-04-30", "url": "https://www.ibm.com/support/pages/node/7149801" } ], "source_lang": "en-US", "title": "IBM Rational ClearQuest: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-04-29T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:59:23.892+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-2550", "initial_release_date": "2023-10-03T22:00:00.000+00:00", "revision_history": [ { "date": "2023-10-03T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-03-07T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-04-29T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "7.3", "product": { "name": "IBM AIX 7.3", "product_id": "1139691", "product_identification_helper": { "cpe": "cpe:/o:ibm:aix:7.3" } } }, { "category": "product_version", "name": "7.2", "product": { "name": "IBM AIX 7.2", "product_id": "434967", "product_identification_helper": { "cpe": "cpe:/o:ibm:aix:7.2" } } } ], "category": "product_name", "name": "AIX" }, { "category": "product_name", "name": "IBM MQ", "product": { "name": "IBM MQ", "product_id": "T021398", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c10.0.3", "product": { "name": "IBM Rational ClearQuest \u003c10.0.3", "product_id": "T030177" } }, { "category": "product_version_range", "name": "\u003c9.0.2.8", "product": { "name": "IBM Rational ClearQuest \u003c9.0.2.8", "product_id": "T030204" } }, { "category": "product_version_range", "name": "\u003c9.1.0.5", "product": { "name": "IBM Rational ClearQuest \u003c9.1.0.5", "product_id": "T030211" } } ], "category": "product_name", "name": "Rational ClearQuest" }, { "branches": [ { "category": "product_version", "name": "3.1", "product": { "name": "IBM VIOS 3.1", "product_id": "1039165", "product_identification_helper": { "cpe": "cpe:/a:ibm:vios:3.1" } } }, { "category": "product_version", "name": "4.1", "product": { "name": "IBM VIOS 4.1", "product_id": "1522854", "product_identification_helper": { "cpe": "cpe:/a:ibm:vios:4.1" } } } ], "category": "product_name", "name": "VIOS" } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-32342", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in IBM Rational ClearQuest. Diese werden durch einen zeitbasierten Seitenkanal in der RSA-Entschl\u00fcsselungsimplementierung im IBM GSKit-Crypto verursacht. Ein entfernter, anonymer Angreifer kann diese Schwachstellen durch das Senden einer \u00fcberm\u00e4\u00dfig gro\u00dfen Anzahl von Versuchsnachrichten ausnutzen, um Informationen offenzulegen." } ], "product_status": { "known_affected": [ "1139691", "434967", "1039165", "1522854", "T021398" ] }, "release_date": "2023-10-03T22:00:00.000+00:00", "title": "CVE-2023-32342" }, { "cve": "CVE-2023-33850", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in IBM Rational ClearQuest. Diese werden durch einen zeitbasierten Seitenkanal in der RSA-Entschl\u00fcsselungsimplementierung im IBM GSKit-Crypto verursacht. Ein entfernter, anonymer Angreifer kann diese Schwachstellen durch das Senden einer \u00fcberm\u00e4\u00dfig gro\u00dfen Anzahl von Versuchsnachrichten ausnutzen, um Informationen offenzulegen." } ], "product_status": { "known_affected": [ "1139691", "434967", "1039165", "1522854", "T021398" ] }, "release_date": "2023-10-03T22:00:00.000+00:00", "title": "CVE-2023-33850" } ] }
wid-sec-w-2023-2550
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM Rational ClearQuest stellt eine L\u00f6sung zur Fehler- und \u00c4nderungsverfolgung zur Verf\u00fcgung.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Rational ClearQuest ausnutzen, um Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2550 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2550.json" }, { "category": "self", "summary": "WID-SEC-2023-2550 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2550" }, { "category": "external", "summary": "IBM Security Bulletin 7130904 vom 2024-03-08", "url": "https://www.ibm.com/support/pages/node/7130904" }, { "category": "external", "summary": "IBM Security Bulletin vom 2023-10-03", "url": "https://www.ibm.com/support/pages/node/7041679" }, { "category": "external", "summary": "IBM Security Bulletin 7149801 vom 2024-04-30", "url": "https://www.ibm.com/support/pages/node/7149801" } ], "source_lang": "en-US", "title": "IBM Rational ClearQuest: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-04-29T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:59:23.892+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-2550", "initial_release_date": "2023-10-03T22:00:00.000+00:00", "revision_history": [ { "date": "2023-10-03T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-03-07T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-04-29T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "7.3", "product": { "name": "IBM AIX 7.3", "product_id": "1139691", "product_identification_helper": { "cpe": "cpe:/o:ibm:aix:7.3" } } }, { "category": "product_version", "name": "7.2", "product": { "name": "IBM AIX 7.2", "product_id": "434967", "product_identification_helper": { "cpe": "cpe:/o:ibm:aix:7.2" } } } ], "category": "product_name", "name": "AIX" }, { "category": "product_name", "name": "IBM MQ", "product": { "name": "IBM MQ", "product_id": "T021398", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c10.0.3", "product": { "name": "IBM Rational ClearQuest \u003c10.0.3", "product_id": "T030177" } }, { "category": "product_version_range", "name": "\u003c9.0.2.8", "product": { "name": "IBM Rational ClearQuest \u003c9.0.2.8", "product_id": "T030204" } }, { "category": "product_version_range", "name": "\u003c9.1.0.5", "product": { "name": "IBM Rational ClearQuest \u003c9.1.0.5", "product_id": "T030211" } } ], "category": "product_name", "name": "Rational ClearQuest" }, { "branches": [ { "category": "product_version", "name": "3.1", "product": { "name": "IBM VIOS 3.1", "product_id": "1039165", "product_identification_helper": { "cpe": "cpe:/a:ibm:vios:3.1" } } }, { "category": "product_version", "name": "4.1", "product": { "name": "IBM VIOS 4.1", "product_id": "1522854", "product_identification_helper": { "cpe": "cpe:/a:ibm:vios:4.1" } } } ], "category": "product_name", "name": "VIOS" } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-32342", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in IBM Rational ClearQuest. Diese werden durch einen zeitbasierten Seitenkanal in der RSA-Entschl\u00fcsselungsimplementierung im IBM GSKit-Crypto verursacht. Ein entfernter, anonymer Angreifer kann diese Schwachstellen durch das Senden einer \u00fcberm\u00e4\u00dfig gro\u00dfen Anzahl von Versuchsnachrichten ausnutzen, um Informationen offenzulegen." } ], "product_status": { "known_affected": [ "1139691", "434967", "1039165", "1522854", "T021398" ] }, "release_date": "2023-10-03T22:00:00.000+00:00", "title": "CVE-2023-32342" }, { "cve": "CVE-2023-33850", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in IBM Rational ClearQuest. Diese werden durch einen zeitbasierten Seitenkanal in der RSA-Entschl\u00fcsselungsimplementierung im IBM GSKit-Crypto verursacht. Ein entfernter, anonymer Angreifer kann diese Schwachstellen durch das Senden einer \u00fcberm\u00e4\u00dfig gro\u00dfen Anzahl von Versuchsnachrichten ausnutzen, um Informationen offenzulegen." } ], "product_status": { "known_affected": [ "1139691", "434967", "1039165", "1522854", "T021398" ] }, "release_date": "2023-10-03T22:00:00.000+00:00", "title": "CVE-2023-33850" } ] }
CERTFR-2023-AVI-0839
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneVendor | Product | Description | ||
---|---|---|---|---|
IBM | Sterling | IBM Sterling Order Management versions 10.0.x antérieures à 10.0.2309.0 | ||
IBM | N/A | IBM Db2 on Cloud Pak for Data versions 3.5, 4.0, 4.5, 4.6, 4.7 antérieures à 4.7 Refresh 3 | ||
IBM | Db2 | IBM Db2 versions 10.5.0.x sans les derniers correctifs de sécurité | ||
IBM | Db2 | IBM Db2 versions 11.1.4.x sans les derniers correctifs de sécurité | ||
IBM | Db2 | IBM Db2 REST versions 1.0.0.121-amd64 à 1.0.0.276-amd64 antérieures à 1.0.0.291-amd64 | ||
IBM | N/A | IBM Db2 Warehouse on Cloud Pak for Data versions 3.5, 4.0, 4.5, 4.6, 4.7 antérieures à 4.7 Refresh 3 | ||
IBM | Db2 | IBM Db2 versions 11.5.x sans les derniers correctifs de sécurité | ||
IBM | QRadar | IBM QRadar Network Packet Capture versions 7.5.x antérieures à 7.5.0 UP6 | ||
IBM | QRadar SIEM | IBM QRadar SIEM versions 7.5.x antérieures à 7.5.0 UP7 |
Title | Publication Time | Tags | |||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "IBM Sterling Order Management versions 10.0.x ant\u00e9rieures \u00e0 10.0.2309.0", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Db2 on Cloud Pak for Data versions 3.5, 4.0, 4.5, 4.6, 4.7 ant\u00e9rieures \u00e0 4.7 Refresh 3", "product": { "name": "N/A", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Db2 versions 10.5.0.x sans les derniers correctifs de s\u00e9curit\u00e9", "product": { "name": "Db2", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Db2 versions 11.1.4.x sans les derniers correctifs de s\u00e9curit\u00e9", "product": { "name": "Db2", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Db2 REST versions 1.0.0.121-amd64 \u00e0 1.0.0.276-amd64 ant\u00e9rieures \u00e0 1.0.0.291-amd64", "product": { "name": "Db2", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Db2 Warehouse on Cloud Pak for Data versions 3.5, 4.0, 4.5, 4.6, 4.7 ant\u00e9rieures \u00e0 4.7 Refresh 3", "product": { "name": "N/A", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Db2 versions 11.5.x sans les derniers correctifs de s\u00e9curit\u00e9", "product": { "name": "Db2", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM QRadar Network Packet Capture versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 UP6", "product": { "name": "QRadar", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM QRadar SIEM versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 UP7", "product": { "name": "QRadar SIEM", "vendor": { "name": "IBM", "scada": false } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2023-21938", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21938" }, { "name": "CVE-2019-17267", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17267" }, { "name": "CVE-2023-21843", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21843" }, { "name": "CVE-2022-21426", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21426" }, { "name": "CVE-2023-33201", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201" }, { "name": "CVE-2023-32697", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32697" }, { "name": "CVE-2023-30991", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30991" }, { "name": "CVE-2023-29404", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29404" }, { "name": "CVE-2020-9546", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9546" }, { "name": "CVE-2023-21954", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21954" }, { "name": "CVE-2023-21939", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21939" }, { "name": "CVE-2020-13956", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13956" }, { "name": "CVE-2023-29256", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29256" }, { "name": "CVE-2020-10673", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10673" }, { "name": "CVE-2020-35728", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35728" }, { "name": "CVE-2020-36181", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36181" }, { "name": "CVE-2020-9548", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9548" }, { "name": "CVE-2023-21830", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21830" }, { "name": "CVE-2020-36182", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36182" }, { "name": "CVE-2020-24616", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24616" }, { "name": "CVE-2023-30431", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30431" }, { "name": "CVE-2022-42703", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42703" }, { "name": "CVE-2020-36185", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36185" }, { "name": "CVE-2023-0286", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0286" }, { "name": "CVE-2023-32067", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32067" }, { "name": "CVE-2022-25147", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25147" }, { "name": "CVE-2019-16942", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16942" }, { "name": "CVE-2020-9547", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9547" }, { "name": "CVE-2020-36179", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36179" }, { "name": "CVE-2023-29403", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29403" }, { "name": "CVE-2023-35012", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35012" }, { "name": "CVE-2023-30443", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30443" }, { "name": "CVE-2020-36186", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36186" }, { "name": "CVE-2020-36189", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36189" }, { "name": "CVE-2020-35490", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35490" }, { "name": "CVE-2023-29405", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29405" }, { "name": "CVE-2023-34454", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34454" }, { "name": "CVE-2023-27869", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27869" }, { "name": "CVE-2021-20190", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20190" }, { "name": "CVE-2023-26049", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26049" }, { "name": "CVE-2023-32342", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32342" }, { "name": "CVE-2023-2828", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2828" }, { "name": "CVE-2023-30446", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30446" }, { "name": "CVE-2019-16335", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16335" }, { "name": "CVE-2023-34453", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34453" }, { "name": "CVE-2023-29007", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29007" }, { "name": "CVE-2019-14893", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14893" }, { "name": "CVE-2022-3564", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3564" }, { "name": "CVE-2020-11113", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11113" }, { "name": "CVE-2023-27868", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27868" }, { "name": "CVE-2023-35116", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35116" }, { "name": "CVE-2023-20867", "url": "https://www.cve.org/CVERecord?id=CVE-2023-20867" }, { "name": "CVE-2023-28709", "url": "https://www.cve.org/CVERecord?id=CVE-2023-28709" }, { "name": "CVE-2020-10672", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10672" }, { "name": "CVE-2023-0767", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0767" }, { "name": "CVE-2020-10969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10969" }, { "name": "CVE-2023-30445", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30445" }, { "name": "CVE-2022-40609", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40609" }, { "name": "CVE-2020-36187", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36187" }, { "name": "CVE-2023-30447", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30447" }, { "name": "CVE-2023-30442", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30442" }, { "name": "CVE-2023-34455", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34455" }, { "name": "CVE-2023-30441", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30441" }, { "name": "CVE-2020-11620", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11620" }, { "name": "CVE-2023-27867", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27867" }, { "name": "CVE-2023-34396", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34396" }, { "name": "CVE-2020-24750", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24750" }, { "name": "CVE-2022-37434", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37434" }, { "name": "CVE-2023-39976", "url": "https://www.cve.org/CVERecord?id=CVE-2023-39976" }, { "name": "CVE-2019-16943", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16943" }, { "name": "CVE-2022-4378", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4378" }, { "name": "CVE-2020-28491", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28491" }, { "name": "CVE-2019-20330", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20330" }, { "name": "CVE-2020-14195", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14195" }, { "name": "CVE-2023-21937", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21937" }, { "name": "CVE-2023-22809", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22809" }, { "name": "CVE-2020-35491", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35491" }, { "name": "CVE-2019-17531", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17531" }, { "name": "CVE-2023-33850", "url": "https://www.cve.org/CVERecord?id=CVE-2023-33850" }, { "name": "CVE-2023-30448", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30448" }, { "name": "CVE-2020-14061", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14061" }, { "name": "CVE-2023-2597", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2597" }, { "name": "CVE-2020-11619", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11619" }, { "name": "CVE-2022-48339", "url": "https://www.cve.org/CVERecord?id=CVE-2022-48339" }, { "name": "CVE-2023-27558", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27558" }, { "name": "CVE-2020-36183", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36183" }, { "name": "CVE-2020-8840", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8840" }, { "name": "CVE-2023-38408", "url": "https://www.cve.org/CVERecord?id=CVE-2023-38408" }, { "name": "CVE-2023-34981", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34981" }, { "name": "CVE-2023-30449", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30449" }, { "name": "CVE-2020-36184", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36184" }, { "name": "CVE-2023-30994", "url": "https://www.cve.org/CVERecord?id=CVE-2023-30994" }, { "name": "CVE-2020-36180", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36180" }, { "name": "CVE-2023-21968", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21968" }, { "name": "CVE-2019-14540", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14540" }, { "name": "CVE-2023-21930", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21930" }, { "name": "CVE-2023-25652", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25652" }, { "name": "CVE-2023-24998", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24998" }, { "name": "CVE-2023-23487", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23487" }, { "name": "CVE-2020-10968", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10968" }, { "name": "CVE-2020-25649", "url": "https://www.cve.org/CVERecord?id=CVE-2020-25649" }, { "name": "CVE-2023-2976", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2976" }, { "name": "CVE-2023-40367", "url": "https://www.cve.org/CVERecord?id=CVE-2023-40367" }, { "name": "CVE-2023-29402", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29402" }, { "name": "CVE-2023-26048", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26048" }, { "name": "CVE-2020-11112", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11112" }, { "name": "CVE-2023-21967", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21967" }, { "name": "CVE-2020-11111", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11111" }, { "name": "CVE-2023-34149", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34149" }, { "name": "CVE-2020-14060", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14060" }, { "name": "CVE-2020-36188", "url": "https://www.cve.org/CVERecord?id=CVE-2020-36188" }, { "name": "CVE-2016-1000027", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1000027" }, { "name": "CVE-2019-14892", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14892" }, { "name": "CVE-2020-14062", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14062" } ], "initial_release_date": "2023-10-13T00:00:00", "last_revision_date": "2023-10-13T00:00:00", "links": [], "reference": "CERTFR-2023-AVI-0839", "revisions": [ { "description": "Version initiale", "revision_date": "2023-10-13T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "\u00c9l\u00e9vation de privil\u00e8ges" }, { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" }, { "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Injection de code indirecte \u00e0 distance (XSS)" }, { "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une\n\u00e9l\u00e9vation de privil\u00e8ges.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7047565 du 06 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7047565" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7049129 du 10 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7049129" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7047481 du 06 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7047481" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7049434 du 10 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7049434" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7047499 du 06 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7047499" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7047754 du 06 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7047754" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7049133 du 10 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7049133" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7047724 du 06 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7047724" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7049435 du 10 octobre 2023", "url": "https://www.ibm.com/support/pages/node/7049435" } ] }
CERTFR-2023-AVI-0705
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneVendor | Product | Description | ||
---|---|---|---|---|
IBM | Sterling | IBM Sterling Secure Proxy versions versions antérieures à 6.0.3 sans le correctif de sécurité iFix08 | ||
IBM | Sterling | IBM Sterling External Authentication Server versions antérieures à 6.0.3 sans le correctif de sécurité iFix 08 | ||
IBM | Sterling | IBM Sterling Secure Proxy versions versions antérieures à 6.1.0 sans le correctif de sécurité GA | ||
IBM | QRadar User Behavior Analytics | IBM QRadar User Behavior Analytics versions antérieures à 4.1.13 | ||
IBM | Tivoli Monitoring | IBM Tivoli Monitoring versions 6.x.x antérieures à 6.3.0.7 Plus Service Pack 5 | ||
IBM | Cloud Pak | IBM Cognos Dashboards on Cloud Pak for Data versions 4.7.x antérieures à 4.7.2 | ||
IBM | Sterling | IBM Sterling External Authentication Server versions antérieures à 6.1.0 sans le correctif de sécurité iFix 04 |
Title | Publication Time | Tags | |||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "IBM Sterling Secure Proxy versions versions ant\u00e9rieures \u00e0 6.0.3 sans le correctif de s\u00e9curit\u00e9 iFix08", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling External Authentication Server versions ant\u00e9rieures \u00e0 6.0.3 sans le correctif de s\u00e9curit\u00e9 iFix 08", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Secure Proxy versions versions ant\u00e9rieures \u00e0 6.1.0 sans le correctif de s\u00e9curit\u00e9 GA", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM QRadar User Behavior Analytics versions ant\u00e9rieures \u00e0 4.1.13", "product": { "name": "QRadar User Behavior Analytics", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Tivoli Monitoring versions 6.x.x ant\u00e9rieures \u00e0 6.3.0.7 Plus Service Pack 5", "product": { "name": "Tivoli Monitoring", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Cognos Dashboards on Cloud Pak for Data versions 4.7.x ant\u00e9rieures \u00e0 4.7.2", "product": { "name": "Cloud Pak", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling External Authentication Server versions ant\u00e9rieures \u00e0 6.1.0 sans le correctif de s\u00e9curit\u00e9 iFix 04", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2023-21938", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21938" }, { "name": "CVE-2022-32213", "url": "https://www.cve.org/CVERecord?id=CVE-2022-32213" }, { "name": "CVE-2023-32697", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32697" }, { "name": "CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "name": "CVE-2020-28498", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28498" }, { "name": "CVE-2023-37920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-37920" }, { "name": "CVE-2023-21939", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21939" }, { "name": "CVE-2023-27554", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27554" }, { "name": "CVE-2023-1436", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1436" }, { "name": "CVE-2021-23440", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23440" }, { "name": "CVE-2022-25883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25883" }, { "name": "CVE-2020-13936", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13936" }, { "name": "CVE-2023-26049", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26049" }, { "name": "CVE-2023-32342", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32342" }, { "name": "CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "name": "CVE-2022-39161", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39161" }, { "name": "CVE-2021-43803", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43803" }, { "name": "CVE-2022-32222", "url": "https://www.cve.org/CVERecord?id=CVE-2022-32222" }, { "name": "CVE-2023-24966", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24966" }, { "name": "CVE-2022-32212", "url": "https://www.cve.org/CVERecord?id=CVE-2022-32212" }, { "name": "CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "name": "CVE-2022-40609", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40609" }, { "name": "CVE-2023-26920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26920" }, { "name": "CVE-2021-33813", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33813" }, { "name": "CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "name": "CVE-2023-35890", "url": "https://www.cve.org/CVERecord?id=CVE-2023-35890" }, { "name": "CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "name": "CVE-2023-21937", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21937" }, { "name": "CVE-2022-32215", "url": "https://www.cve.org/CVERecord?id=CVE-2022-32215" }, { "name": "CVE-2021-3803", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3803" }, { "name": "CVE-2023-2597", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2597" }, { "name": "CVE-2023-29261", "url": "https://www.cve.org/CVERecord?id=CVE-2023-29261" }, { "name": "CVE-2021-37699", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37699" }, { "name": "CVE-2023-34104", "url": "https://www.cve.org/CVERecord?id=CVE-2023-34104" }, { "name": "CVE-2022-45685", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45685" }, { "name": "CVE-2023-25690", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25690" }, { "name": "CVE-2023-21968", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21968" }, { "name": "CVE-2022-32214", "url": "https://www.cve.org/CVERecord?id=CVE-2022-32214" }, { "name": "CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "name": "CVE-2023-21930", "url": "https://www.cve.org/CVERecord?id=CVE-2023-21930" }, { "name": "CVE-2023-24998", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24998" }, { "name": "CVE-2023-22874", "url": "https://www.cve.org/CVERecord?id=CVE-2023-22874" }, { "name": "CVE-2023-26136", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26136" }, { "name": "CVE-2023-26048", "url": "https://www.cve.org/CVERecord?id=CVE-2023-26048" }, { "name": "CVE-2023-32338", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32338" }, { "name": "CVE-2022-25858", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25858" } ], "initial_release_date": "2023-09-01T00:00:00", "last_revision_date": "2023-09-01T00:00:00", "links": [], "reference": "CERTFR-2023-AVI-0705", "revisions": [ { "description": "Version initiale", "revision_date": "2023-09-01T00:00:00.000000" } ], "risks": [ { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Injection de code indirecte \u00e0 distance (XSS)" }, { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7029765 du 31 ao\u00fbt 2023", "url": "https://www.ibm.com/support/pages/node/7029765" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7029766 du 31 ao\u00fbt 2023", "url": "https://www.ibm.com/support/pages/node/7029766" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7027925 du 31 ao\u00fbt 2023", "url": "https://www.ibm.com/support/pages/node/7027925" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7029732 du 31 ao\u00fbt 2023", "url": "https://www.ibm.com/support/pages/node/7029732" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7029864 du 31 ao\u00fbt 2023", "url": "https://www.ibm.com/support/pages/node/7029864" } ] }
CERTFR-2024-AVI-0090
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS), une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneVendor | Product | Description | ||
---|---|---|---|---|
IBM | Sterling | IBM Sterling Transformation Extender version 10.1.1 sans le correctif de sécurité APAR PH58716 | ||
IBM | Sterling Control Center | IBM Sterling Control Center versions 6.3.x.x antérieures à 6.3.0.0 iFix05 | ||
IBM | QRadar User Behavior Analytics | QRadar User Behavior Analytics versions antérieures à 4.1.14 | ||
IBM | QRadar Assistant | IBM QRadar Assistant versions antérieures à 3.6.1 | ||
IBM | Sterling | IBM Sterling Transformation Extender version 11.0 sans le correctif de sécurité APAR PH58716 | ||
IBM | Sterling | IBM Sterling Transformation Extender version 10.1.2 sans le correctif de sécurité APAR PH58716 | ||
IBM | Sterling | IBM Sterling Transformation Extender version 10.1.0 sans le correctif de sécurité APAR PH58716 |
Title | Publication Time | Tags | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "IBM Sterling Transformation Extender version 10.1.1 sans le correctif de s\u00e9curit\u00e9 APAR PH58716", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Control Center versions 6.3.x.x ant\u00e9rieures \u00e0 6.3.0.0 iFix05", "product": { "name": "Sterling Control Center", "vendor": { "name": "IBM", "scada": false } } }, { "description": "QRadar User Behavior Analytics versions ant\u00e9rieures \u00e0 4.1.14", "product": { "name": "QRadar User Behavior Analytics", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM QRadar Assistant versions ant\u00e9rieures \u00e0 3.6.1", "product": { "name": "QRadar Assistant", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Transformation Extender version 11.0 sans le correctif de s\u00e9curit\u00e9 APAR PH58716", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Transformation Extender version 10.1.2 sans le correctif de s\u00e9curit\u00e9 APAR PH58716", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Transformation Extender version 10.1.0 sans le correctif de s\u00e9curit\u00e9 APAR PH58716", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2023-1370", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1370" }, { "name": "CVE-2023-45857", "url": "https://www.cve.org/CVERecord?id=CVE-2023-45857" }, { "name": "CVE-2023-0105", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0105" }, { "name": "CVE-2022-25883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25883" }, { "name": "CVE-2023-32342", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32342" }, { "name": "CVE-2022-25927", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25927" }, { "name": "CVE-2018-25031", "url": "https://www.cve.org/CVERecord?id=CVE-2018-25031" }, { "name": "CVE-2021-23445", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23445" }, { "name": "CVE-2021-4048", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4048" }, { "name": "CVE-2021-31684", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31684" }, { "name": "CVE-2023-46604", "url": "https://www.cve.org/CVERecord?id=CVE-2023-46604" }, { "name": "CVE-2023-31484", "url": "https://www.cve.org/CVERecord?id=CVE-2023-31484" }, { "name": "CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "name": "CVE-2023-40743", "url": "https://www.cve.org/CVERecord?id=CVE-2023-40743" } ], "initial_release_date": "2024-02-02T00:00:00", "last_revision_date": "2024-02-02T00:00:00", "links": [], "reference": "CERTFR-2024-AVI-0090", "revisions": [ { "description": "Version initiale", "revision_date": "2024-02-02T00:00:00.000000" } ], "risks": [ { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Injection de code indirecte \u00e0 distance (XSS)" }, { "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)" }, { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0\ndistance (XSS), une ex\u00e9cution de code arbitraire \u00e0 distance et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7114134 du 01 f\u00e9vrier 2024", "url": "https://www.ibm.com/support/pages/node/7114134" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7113520 du 31 janvier 2024", "url": "https://www.ibm.com/support/pages/node/7113520" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7112498 du 30 janvier 2024", "url": "https://www.ibm.com/support/pages/node/7112498" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7113593 du 31 janvier 2024", "url": "https://www.ibm.com/support/pages/node/7113593" } ] }
CERTFR-2023-AVI-0472
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneVendor | Product | Description | ||
---|---|---|---|---|
IBM | Sterling Connect:Direct | IBM Sterling Connect:Direct pour Microsoft Windows versions 6.2.x antérieures à 6.2.0.4_iFix036 | ||
IBM | Sterling Connect:Direct | IBM Sterling Connect:Direct pour Microsoft Windows versions 6.0.x antérieures à 6.0.0.4_iFix067 | ||
IBM | Sterling | IBM Sterling Partner Engagement Manager Essentials Edition et Standard Edition versions 6.2.1.x antérieures à 6.2.1.3 | ||
IBM | Sterling | IBM Sterling Partner Engagement Manager Essentials Edition et Standard Edition versions 6.2.2.x antérieures à 6.2.2.1 | ||
IBM | Sterling Connect:Direct | IBM Sterling Connect:Direct pour Microsoft Windows versions 6.1.x antérieures à 6.1.0.2_iFix062 | ||
IBM | WebSphere | IBM WebSphere Hybrid Edition version 5.1 sans le correctif de sécurité APAR PH54373 (cf. https://www.ibm.com/support/pages/node/6999681) | ||
IBM | Sterling | IBM Sterling Partner Engagement Manager Essentials Edition et Standard Edition versions 6.2.0.x antérieures à 6.2.0.6 | ||
IBM | Sterling | IBM Sterling Partner Engagement Manager Essentials Edition et Standard Edition versions 6.1.2.x antérieures à 6.1.2.8 |
Title | Publication Time | Tags | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "IBM Sterling Connect:Direct pour Microsoft Windows versions 6.2.x ant\u00e9rieures \u00e0 6.2.0.4_iFix036", "product": { "name": "Sterling Connect:Direct", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Connect:Direct pour Microsoft Windows versions 6.0.x ant\u00e9rieures \u00e0 6.0.0.4_iFix067", "product": { "name": "Sterling Connect:Direct", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Partner Engagement Manager Essentials Edition et Standard Edition versions 6.2.1.x ant\u00e9rieures \u00e0 6.2.1.3", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Partner Engagement Manager Essentials Edition et Standard Edition versions 6.2.2.x ant\u00e9rieures \u00e0 6.2.2.1", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Connect:Direct pour Microsoft Windows versions 6.1.x ant\u00e9rieures \u00e0 6.1.0.2_iFix062", "product": { "name": "Sterling Connect:Direct", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM WebSphere Hybrid Edition version 5.1 sans le correctif de s\u00e9curit\u00e9 APAR PH54373 (cf. https://www.ibm.com/support/pages/node/6999681)", "product": { "name": "WebSphere", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Partner Engagement Manager Essentials Edition et Standard Edition versions 6.2.0.x ant\u00e9rieures \u00e0 6.2.0.6", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "IBM Sterling Partner Engagement Manager Essentials Edition et Standard Edition versions 6.1.2.x ant\u00e9rieures \u00e0 6.1.2.8", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2023-28867", "url": "https://www.cve.org/CVERecord?id=CVE-2023-28867" }, { "name": "CVE-2023-32342", "url": "https://www.cve.org/CVERecord?id=CVE-2023-32342" }, { "name": "CVE-2023-2597", "url": "https://www.cve.org/CVERecord?id=CVE-2023-2597" } ], "initial_release_date": "2023-06-16T00:00:00", "last_revision_date": "2023-06-16T00:00:00", "links": [], "reference": "CERTFR-2023-AVI-0472", "revisions": [ { "description": "Version initiale", "revision_date": "2023-06-16T00:00:00.000000" } ], "risks": [ { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Ex\u00e9cution de code arbitraire" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7003245 du 12 juin 2023", "url": "https://www.ibm.com/support/pages/node/7003245" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7004175 du 15 juin 2023", "url": "https://www.ibm.com/support/pages/node/7004175" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 IBM 7004153 du 15 juin 2023", "url": "https://www.ibm.com/support/pages/node/7004153" } ] }
cnvd-2023-43866
Vulnerability from cnvd
厂商已发布了漏洞修复程序,请及时关注更新: https://www.ibm.com/support/pages/node/6998037
Name | ['IBM global security kit 8.5', 'IBM global security kit 9.0'] |
---|
{ "cves": { "cve": { "cveNumber": "CVE-2023-32342", "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-32342" } }, "description": "IBM Global Security Kit\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e3aSSL\u6216TLS\u901a\u4fe1\u63d0\u4f9b\u5e93\u548c\u5b9e\u7528\u7a0b\u5e8f\u3002\n\nIBM Global Security Kit\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eRSA\u89e3\u5bc6\u5b9e\u73b0\u4e2d\u57fa\u4e8e\u65f6\u95f4\u7684\u4fa7\u901a\u9053\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u8fc7\u591a\u7684\u8bd5\u7528\u6d88\u606f\u8fdb\u884c\u89e3\u5bc6\uff0c\u8fdb\u800c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002", "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/6998037", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2023-43866", "openTime": "2023-06-02", "patchDescription": "IBM Global Security Kit\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e3aSSL\u6216TLS\u901a\u4fe1\u63d0\u4f9b\u5e93\u548c\u5b9e\u7528\u7a0b\u5e8f\u3002\r\n\r\nIBM Global Security Kit\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eRSA\u89e3\u5bc6\u5b9e\u73b0\u4e2d\u57fa\u4e8e\u65f6\u95f4\u7684\u4fa7\u901a\u9053\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u8fc7\u591a\u7684\u8bd5\u7528\u6d88\u606f\u8fdb\u884c\u89e3\u5bc6\uff0c\u8fdb\u800c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "IBM Global Security Kit\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01", "products": { "product": [ "IBM global security kit 8.5", "IBM global security kit 9.0" ] }, "referenceLink": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828", "serverity": "\u9ad8", "submitTime": "2023-06-01", "title": "IBM Global Security Kit\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e" }
fkie_cve-2023-32342
Vulnerability from fkie_nvd
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
URL | Tags | ||
---|---|---|---|
psirt@us.ibm.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/255828 | VDB Entry, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/255828 | VDB Entry, Vendor Advisory |
Vendor | Product | Version | |
---|---|---|---|
ibm | http_server | * | |
ibm | http_server | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "59E31948-A20E-4B41-A65C-67C0F64611F6", "versionEndExcluding": "8.5.5.24", "versionStartIncluding": "8.5.0.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "A31D0CD4-3CB3-4BD9-A97E-DC9CF053A6A8", "versionEndExcluding": "9.0.5.16", "versionStartIncluding": "9.0.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828." } ], "id": "CVE-2023-32342", "lastModified": "2024-11-21T08:03:09.113", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2023-05-30T22:15:10.677", "references": [ { "source": "psirt@us.ibm.com", "tags": [ "VDB Entry", "Vendor Advisory" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "VDB Entry", "Vendor Advisory" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828" } ], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-203" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
gsd-2023-32342
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2023-32342", "id": "GSD-2023-32342" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2023-32342" ], "details": "IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828.", "id": "GSD-2023-32342", "modified": "2023-12-13T01:20:23.678164Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2023-32342", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "GSKit", "version": { "version_data": [ { "version_affected": "=", "version_value": " " } ] } } ] }, "vendor_name": "IBM" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828." } ] }, "generator": { "engine": "Vulnogram 0.1.0-dev" }, "impact": { "cvss": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "208 Information Exposure Through Timing Discrepancy" } ] } ] }, "references": { "reference_data": [ { "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828", "refsource": "MISC", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828" } ] }, "source": { "discovery": "UNKNOWN" } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "9.0.5.16", "versionStartIncluding": "9.0.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "8.5.5.24", "versionStartIncluding": "8.5.0.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2023-32342" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-203" } ] } ] }, "references": { "reference_data": [ { "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828", "refsource": "MISC", "tags": [ "VDB Entry", "Vendor Advisory" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2023-06-06T18:18Z", "publishedDate": "2023-05-30T22:15Z" } } }
ghsa-5wv7-mwwf-5g8c
Vulnerability from github
IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828.
{ "affected": [], "aliases": [ "CVE-2023-32342" ], "database_specific": { "cwe_ids": [ "CWE-203" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-05-30T22:15:10Z", "severity": "HIGH" }, "details": "IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828.", "id": "GHSA-5wv7-mwwf-5g8c", "modified": "2024-04-04T04:24:05Z", "published": "2023-05-31T00:31:05Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32342" }, { "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/255828" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.