PT-2021-14542 · Sap · Sap Hana Database

Published 2021-02-09 · Updated 2022-07-12 · CVE-2021-21474

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA Database versions 1.0, 2.0

Description The issue allows an attacker to tamper with SAML tokens that use MD5 digest, potentially impersonating a user in the HANA database and accessing its contents. This is possible because an attacker who obtains an MD5-digest signed SAML Assertion might be able to alter it without invalidating the digital signature.

Recommendations For SAP HANA Database versions 1.0 and 2.0, consider disabling the acceptance of SAML tokens with MD5 digest until a patch is available. As a temporary workaround, restrict access to sensitive data in the database to minimize the risk of exploitation. Avoid using MD5-digest signed SAML Assertions in the affected SAP HANA instances until the issue is resolved.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2021-21474

Affected Products

Sap Hana Database

References · 6

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21474 · Security Note
• https://t.me/cibsecurity/23343 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2992154 · Note
• https://t.me/cvenotify/9689 · Telegram Post