PT-2018-4906 · Ibm · Ibm Rational Clearquest

Publicado 2018-08-13 · Atualizado 2019-10-09 · CVE-2016-2922

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions 8.0 through 8.0.1.9 IBM Rational ClearQuest versions 9.0 through 9.0.1.3

Description The issue allows for a man-in-the-middle attack, where an impersonating server can observe all data transmitted to the real server. This occurs because the software fails to check the SSL certificate against the requested hostname.

Recommendations For IBM Rational ClearQuest versions 8.0 through 8.0.1.9, update to a version that properly checks SSL certificates. For IBM Rational ClearQuest versions 9.0 through 9.0.1.3, update to a version that properly checks SSL certificates. As a temporary workaround, consider disabling the use of SSL connections or restricting access to trusted networks until a patch is available.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2016-2922

Produtos afetados

Ibm Rational Clearquest

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-2922 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/113353 · Aviso do Fabricante
• https://ibm.com/support/docview.wss?uid=ibm10718377 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-2922 · Aviso do Fabricante