PT-2019-9822 · Ibm · Ibm Security Identity Governance/Intelligence

Published 2019-02-21 · Updated 2019-10-09 · CVE-2018-1946

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Identity Governance and Intelligence versions 5.2 through 5.2.4.1 Virtual Appliance

Description The issue arises from the software's ability to interact between multiple actors and negotiate the algorithm used for protection mechanisms like encryption or authentication. However, it fails to select the strongest available algorithm that both parties can use.

Recommendations For IBM Security Identity Governance and Intelligence versions 5.2 through 5.2.4.1 Virtual Appliance, consider configuring the system to prioritize and enforce the use of the strongest available encryption or authentication algorithms until a patch is available.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2018-1946

Affected Products

Ibm Security Identity Governance/Intelligence

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/153388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1946 · Security Note
• https://ibm.com/support/docview.wss?uid=ibm10872142 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1946 · Vendor Advisory