PT-2023-21769 · Rocket · Unidata+1

Ron Bowes · Published 2023-03-29 · Updated 2023-04-06 · CVE-2023-28509

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rocket Software UniData versions prior to 8.2.4 build 3003 Rocket Software UniVerse versions prior to 11.3.5 build 1001 Rocket Software UniVerse versions prior to 12.2.1 build 2002

Description The issue concerns the use of weak encryption for packet-level security and passwords transferred on the wire.

Recommendations For Rocket Software UniData versions prior to 8.2.4 build 3003, update to version 8.2.4 build 3003 or later. For Rocket Software UniVerse versions prior to 11.3.5 build 1001, update to version 11.3.5 build 1001 or later. For Rocket Software UniVerse versions prior to 12.2.1 build 2002, update to version 12.2.1 build 2002 or later.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2023-28509

Affected Products

Unidata

Universe

References · 6

• https://osv.dev/vulnerability/CVE-2023-28509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28509 · Security Note
• https://t.me/cibsecurity/61144 · Telegram Post
• https://t.me/cybersecuritytechnologies/8026 · Telegram Post
• https://rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed · Note
• https://t.me/cvenotify/47703 · Telegram Post