PT-2022-10851 · Ibm · Ibm Guardium Data Encryption

Ben Goodspeed + 8 · Published 2022-05-06 · Updated 2023-01-24 · CVE-2021-39027

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Encryption (GDE) versions 4.0.0 through 5.0.0

Description The issue arises from IBM Guardium Data Encryption (GDE) preparing a structured message for communication with another component, but the encoding or escaping of the data is either missing or done incorrectly. This results in the intended structure of the message not being preserved.

Recommendations For versions 4.0.0 and 5.0.0, consider implementing proper encoding or escaping of the data in the structured message to preserve its intended structure. As a temporary workaround, review and adjust the communication protocol between components to minimize the risk of message structure corruption.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2021-39027

Affected Products

Ibm Guardium Data Encryption

References · 7

• https://osv.dev/vulnerability/CVE-2021-39027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39027 · Security Note
• https://ibm.com/support/pages/node/6582499 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/213865 · Vendor Advisory
• https://t.me/cibsecurity/42130 · Telegram Post
• https://t.me/cvenotify/29803 · Telegram Post
• https://t.me/cvenotify/42731 · Telegram Post