PT-2019-11084 · Hewlett Packard · Hpe Nonstop Safeguard+1

Published 2019-05-10 · Updated 2020-08-24 · CVE-2018-7119

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: HPE NonStop Safeguard versions earlier than SPR T9750L01^AIC or T9750H05^AIH HPE NonStop Standard Security versions prior to T6533L01^ADU or T6533H05^ADW All versions of HPE NonStop Safeguard and HPE NonStop Standard Security on H-series when the PASSWORD-PROMPT configuration attribute is not set to BLIND

Description: A Local Disclosure of Sensitive Information issue was identified, which may lead to the exposure of sensitive credentials. Some commands in the affected software require the username and password to be passed as command line parameters, potentially disclosing the credentials locally.

Recommendations: For HPE NonStop Safeguard versions earlier than SPR T9750L01^AIC or T9750H05^AIH, update to a version that includes the fix. For HPE NonStop Standard Security versions prior to T6533L01^ADU or T6533H05^ADW, update to a version that includes the fix. For all versions on H-series, set the PASSWORD-PROMPT configuration attribute to BLIND to mitigate the issue. As a temporary workaround, consider avoiding the use of commands that require username and password as command line parameters until a patch is available.

Fix

Related Identifiers

CVE-2018-7119

Affected Products

Hpe Nonstop Safeguard

Hpe Nonstop Standard Security

References · 3

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03910en_us · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7119 · Security Note