Security Bulletin: IBM Security Guardium is affected by a Weak Password Policy vulnerability (CVE-2021-20418)

Summary

IBM Security Guardium has fixed this vulnerability

Vulnerability Details

CVEID:CVE-2021-20418
**DESCRIPTION:**IBM Security Guardium does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/196279 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N)

Affected Products and Versions

IBM Security Guardium| 10.6

IBM Security Guardium| 11.0

IBM Security Guardium| 11.1

IBM Security Guardium| 11.2

IBM Security Guardium| 11.3

Remediation/Fixes

http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=10.0&platform=Linux&function=fixId&fixids=SqlGuard_10.0p545_Bundle_Oct-19-2021&includeSupersedes=0&source=fc

IBM Security Guardium| 10.6
|

http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=10.0&platform=Linux&function=fixId&fixids=SqlGuard_10.0p675_Bundle_Aug-11-2021&includeSupersedes=0&source=fc

IBM Security Guardium| 11.0
|

http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p40_Bundle_Oct-04-2021&includeSupersedes=0&source=fc

IBM Security Guardium| 11.1
|

http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p150_Bundle_Oct-26-2021&includeSupersedes=0&source=fc

IBM Security Guardium| 11.2
|

http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p250_Bundle_Jul-14-2021&includeSupersedes=0&source=fc

IBM Security Guardium| 11.3
|

http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p330_Bundle_Oct-06-2021&includeSupersedes=0&source=fc

Workarounds and Mitigations

None