github - ghsa-m7f9-w9g7-x6f7

ghsa-m7f9-w9g7-x6f7

Vulnerability from github

Published

2022-05-13 01:49

Modified

2022-05-13 01:49

Severity ?

8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-1447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-916"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-04T18:29:00Z",
    "severity": "HIGH"
  },
  "details": "The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.",
  "id": "GHSA-m7f9-w9g7-x6f7",
  "modified": "2022-05-13T01:49:56Z",
  "published": "2022-05-13T01:49:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1447"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139972"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22014669"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22014957"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22015066"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22015071"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/104511"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041012"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2018-1447

Vulnerability from cvelistv5

Published

2018-04-04 18:00

Modified

2024-09-17 01:50

Severity ?

5.1 (Medium) - CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

▼	URL	Tags
	http://www.ibm.com/support/docview.wss?uid=swg22015066	x_refsource_CONFIRM
	http://www.ibm.com/support/docview.wss?uid=swg22014957	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/139972	x_refsource_MISC
	http://www.ibm.com/support/docview.wss?uid=swg22015071	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/104511	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1041012	vdb-entry, x_refsource_SECTRACK
	http://www.ibm.com/support/docview.wss?uid=swg22014669	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

IBM

Spectrum Protect

Version: 7.1
Version: 8.1

IBM	Spectrum Protect Snapshot	Version: 4.1.3 Version: 4.1.4 Version: 4.1.6
IBM	Spectrum Protect for Virtual Environments	Version: 7.1 Version: 8.1
IBM	Spectrum Protect for Space Management	Version: 7.1 Version: 8.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:59:39.101Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg22015066"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg22014957"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139972"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg22015071"
          },
          {
            "name": "104511",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104511"
          },
          {
            "name": "1041012",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041012"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg22014669"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spectrum Protect",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "affected",
              "version": "8.1"
            }
          ]
        },
        {
          "product": "Spectrum Protect Snapshot",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.3"
            },
            {
              "status": "affected",
              "version": "4.1.4"
            },
            {
              "status": "affected",
              "version": "4.1.6"
            }
          ]
        },
        {
          "product": "Spectrum Protect for Virtual Environments",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "affected",
              "version": "8.1"
            }
          ]
        },
        {
          "product": "Spectrum Protect for Space Management",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "affected",
              "version": "8.1"
            }
          ]
        }
      ],
      "datePublic": "2018-03-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/A:N/AC:H/AV:L/C:H/I:N/PR:N/S:U/UI:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Obtain Information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T09:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg22015066"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg22014957"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139972"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg22015071"
        },
        {
          "name": "104511",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104511"
        },
        {
          "name": "1041012",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041012"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg22014669"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2018-03-29T00:00:00",
          "ID": "CVE-2018-1447",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spectrum Protect",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.1"
                          },
                          {
                            "version_value": "8.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Spectrum Protect Snapshot",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.1.3"
                          },
                          {
                            "version_value": "4.1.4"
                          },
                          {
                            "version_value": "4.1.6"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Spectrum Protect for Virtual Environments",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.1"
                          },
                          {
                            "version_value": "8.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Spectrum Protect for Space Management",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.1"
                          },
                          {
                            "version_value": "8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "H",
              "AV": "L",
              "C": "H",
              "I": "N",
              "PR": "N",
              "S": "U",
              "UI": "N"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Obtain Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg22015066",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg22015066"
            },
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg22014957",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg22014957"
            },
            {
              "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139972",
              "refsource": "MISC",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/139972"
            },
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg22015071",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg22015071"
            },
            {
              "name": "104511",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104511"
            },
            {
              "name": "1041012",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041012"
            },
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg22014669",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg22014669"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2018-1447",
    "datePublished": "2018-04-04T18:00:00Z",
    "dateReserved": "2017-12-13T00:00:00",
    "dateUpdated": "2024-09-17T01:50:34.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted