7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
70.6%
OpenSSL is used by the IBM Security Verify Adapters as part of its SSL communication. IBM Security Verify Adapters are vulnerable to denial of service (CVE-2021-3449) and could allow a remote attacker to bypass security restrictions (CVE-2021-3450) The fix includes OpenSSL version 1.1.1k.
CVEID:CVE-2021-3449
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signature_algorithms processing. By sending a specially crafted renegotiation ClientHello message from a client, a remote attacker could exploit this vulnerability to cause the TLS server to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/198752 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2021-3450
**DESCRIPTION:**OpenSSL could allow a remote attacker to bypass security restrictions, caused by a missing check in the validation logic of X.509 certificate chains by the X509_V_FLAG_X509_STRICT flag. By using any valid certificate or certificate chain to sign a specially crafted certificate, an attacker could bypass the check that non-CA certificates must not be able to issue other certificates and override the default purpose.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/198754 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
Adapter Name
|
Version
—|—
IBM Security Verify Adapter for Lotus Notes | 7.1.16, 6.0.16
IBM Security Verify Adapter for Microsoft SQL Server | 7.1.18, 6.0.18
IBM Security Verify Adapter for Windows Active Directory | 10.0.1
IBM Security Verify Adapter for Windows Local Accounts | 7.1.20, 6.0.20
IBM encourages customers to update their systems promptly.
Adapter Name
|
Version
—|—
IBM Security Verify Adapter for Lotus Notes | 10.0.1 or higher
IBM Security Verify Adapter for Microsoft SQL Server | 10.0.1 or higher
IBM Security Verify Adapter for Windows Active Directory | 10.0.2 or higher
IBM Security Verify Adapter for Windows Local Accounts | 10.0.1 or higher
To download the IBM Security Verify Adapter, sign into IBM Passport Advantage Online (PAO) website. Note, you must be an authorized user from your company to sign in.
Enter the adapter name text string for search by Product name.
None
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
70.6%