Lucene search

IBMAEF359031CFD9876F95CEFF435DE6BD6C04B0D90170F13B516E64FD86EDF400A

HistoryJun 26, 2024 - 4:24 p.m.

Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty may affect IBM Storage Protect for Virtual Environments: Data Protection for VMware

2024-06-2616:24:03

www.ibm.com

ibm

websphere

liberty

storage protect

virtual environments

data protection

vmware

tls

cve-2023-50312

vulnerability

upgrade

remediation

linux

windows

CVSS3

5.3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.8

Confidence

High

JSON

Summary

IBM Storage Protect for Virtual Environments: Data Protection for VMware can be affected by a security flaw in IBM WebSphere Application Server Liberty. The flaw can lead to weaker than expected security for outbound TLS connections, as described in the “Vulnerability Details” section. CVE-2023-50312.

Vulnerability Details

CVEID:CVE-2023-50312
**DESCRIPTION:**IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/274711 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Storage Protect for Virtual Environments: Data Protection for VMware	8.1.0.0 - 8.1.22.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerabilities now by upgrading.

Product	Fixing level	Platforms	Link to fix and instructions
IBM Storage Protect for Virtual Environments: Data Protection for VMware	8.1.23.0	Linux
Windows	Download Information: IBM Storage Protect for Virtual Environments 8.1.23

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmstorage_protect_for_virtual_environmentsMatch8.1

VendorProductVersionCPE
ibmstorage_protect_for_virtual_environments8.1cpe:2.3:a:ibm:storage_protect_for_virtual_environments:8.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	storage_protect_for_virtual_environments	8.1	cpe:2.3:a:ibm:storage_protect_for_virtual_environments:8.1:::::::*

CVSS3

5.3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.8

Confidence

High

JSON

Related for AEF359031CFD9876F95CEFF435DE6BD6C04B0D90170F13B516E64FD86EDF400A