PT-2014-8634 · Sap · Sapcryptolib+4

Published 2014-11-04 · Updated 2023-10-03 · CVE-2014-8587

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAPCRYPTOLIB versions prior to 5.555.38 SAPSECULIB (affected versions not specified) CommonCryptoLib versions prior to 8.4.30

Description The issue allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors. This affects SAP NetWeaver AS for ABAP and SAP HANA.

Recommendations For SAPCRYPTOLIB versions prior to 5.555.38, update to version 5.555.38 or later. For SAPSECULIB, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For CommonCryptoLib versions prior to 8.4.30, update to version 8.4.30 or later.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-8587

Affected Products

Commoncryptolib

Sap Hana

Sap Netweaver As Abap

Sapcryptolib

Sapseculib

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-8587 · Security Note
• http://service.sap.com/sap/support/notes/2067859 · Note
• http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing · Note
• https://twitter.com/SAP_Gsupport/status/522401681997570048 · Note
• http://secunia.com/advisories/57606 · Note
• https://t.me/cvenotify/58933 · Telegram Post