PT-2018-17695 · Comforte · Comforte Swap

Published 2018-03-01 · Updated 2019-10-03 · CVE-2018-6653

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions comforte SWAP versions 1049 through 1069 comforte SWAP versions 20.0.0 through 21.5.3

Description The issue makes it easier for remote attackers to defeat intended cryptographic protection mechanisms by sniffing the network, as it does not ensure that clients use a strong TLS cipher suite after executing the RELOAD CERTIFICATES command.

Recommendations For versions 1049 through 1069, update to a version that includes the fix. For versions 20.0.0 through 21.5.3, update to version 21.6.0 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2018-6653

Affected Products

Comforte Swap

References · 4

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03827en_us · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6653 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6653 · Vendor Advisory
• https://comforte.com/cve-2018-6653 · Note