PT-2022-9929 · Ibm · Ibm Secure External Authentication Server+1

Published 2022-05-17 · Updated 2023-01-24 · CVE-2021-29726

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Sterling Secure Proxy version 6.0.3 IBM Secure External Authentication Server version 6.0.3

Description The issue arises from improper validation of certificates, which fails to ensure that a certificate is actually associated with the host.

Recommendations For IBM Sterling Secure Proxy version 6.0.3, update the software to properly validate certificates. For IBM Secure External Authentication Server version 6.0.3, update the software to properly validate certificates. As a temporary workaround, consider restricting the use of certificate validation until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2021-29726

Affected Products

Ibm Secure External Authentication Server

Ibm Sterling Secure Proxy

References · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/201104 · Vendor Advisory
• https://ibm.com/support/pages/node/6586756 · Vendor Advisory
• https://ibm.com/support/pages/node/6586754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29726 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29726 · Vendor Advisory
• https://t.me/cvenotify/30330 · Telegram Post
• https://t.me/cibsecurity/42835 · Telegram Post