PT-2018-4906 · Ibm · Ibm Rational Clearquest

Published 2018-08-13 · Updated 2019-10-09 · CVE-2016-2922

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions 8.0 through 8.0.1.9 IBM Rational ClearQuest versions 9.0 through 9.0.1.3

Description The issue allows for a man-in-the-middle attack, where an impersonating server can observe all data transmitted to the real server. This occurs because the software fails to check the SSL certificate against the requested hostname.

Recommendations For IBM Rational ClearQuest versions 8.0 through 8.0.1.9, update to a version that properly checks SSL certificates. For IBM Rational ClearQuest versions 9.0 through 9.0.1.3, update to a version that properly checks SSL certificates. As a temporary workaround, consider disabling the use of SSL connections or restricting access to trusted networks until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2016-2922

Affected Products

Ibm Rational Clearquest

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-2922 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/113353 · Vendor Advisory
• https://ibm.com/support/docview.wss?uid=ibm10718377 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2922 · Vendor Advisory