PT-2022-9845 · Ibm · Bigfix Compliance

Published 2022-03-04 · Updated 2022-03-12 · CVE-2021-27756

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigFix Compliance versions up to 2.0.5

Description The issue concerns the failure to disable TLS-RSA cipher suites in BigFix Compliance. If TLS 2.0 and secure ciphers are not enabled, an attacker can passively record traffic and later decrypt it.

Recommendations For BigFix Compliance versions up to 2.0.5, enable TLS 2.0 and secure ciphers to prevent the exploitation of this issue. As a temporary workaround, consider disabling the use of TLS-RSA cipher suites until a patch is available. Restrict access to sensitive data transmitted over TLS to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2021-27756

Affected Products

Bigfix Compliance

References · 4

• https://osv.dev/vulnerability/CVE-2021-27756 · Vendor Advisory
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27756 · Security Note
• https://t.me/cibsecurity/38479 · Telegram Post