PT-2021-18439 · Ibm · Ibm Infosphere Information Server

Robin Trost · Published 2021-11-02 · Updated 2021-11-03 · CVE-2021-29737

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7

Description The issue is related to improper validation of the REST API server certificate in the IBM InfoSphere Data Flow Designer Engine component. This could potentially allow for man-in-the-middle attacks or other security breaches. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For IBM InfoSphere Information Server version 11.7, update the component to properly validate the REST API server certificate. As a temporary workaround, consider restricting access to the REST API until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2021-29737

Affected Products

Ibm Infosphere Information Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-29737 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/201301 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29737 · Vendor Advisory
• https://ibm.com/support/pages/node/6509086 · Vendor Advisory
• https://t.me/cibsecurity/31610 · Telegram Post
• https://t.me/cvenotify/22885 · Telegram Post