PT-2024-13899 · Ibm · Ibm Websphere Application Server Liberty

Published 2024-02-28 · Updated 2024-03-01 · CVE-2023-50312

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server Liberty versions 17.0.0.3 through 24.0.0.2

Description The issue is caused by a failure to honor user configuration, which could provide weaker than expected security for outbound TLS connections.

Recommendations For versions 17.0.0.3 through 24.0.0.2, update to a version that honors user configuration for outbound TLS connections to ensure expected security levels. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2023-50312

Affected Products

Ibm Websphere Application Server Liberty

References · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/274711 · Vendor Advisory
• https://ibm.com/support/pages/node/7125527 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50312 · Security Note
• https://twitter.com/knaepp/status/1762900733186179444 · Twitter Post
• https://twitter.com/knaepp/status/1762915837541822481 · Twitter Post
• https://t.me/cvenotify/72742 · Telegram Post
• https://twitter.com/CVEnew/status/1763396861820301415 · Twitter Post