Security Bulletin: IBM Guardium Data Encryption (GDE) has an information exposure vulnerability (CVE-2021-39025)

Summary

An information Exposure was addressed in IBM Guardium Data Encryption (GDE). Please apply the latest version for the fixes.

Vulnerability Details

CVEID:CVE-2021-39025
**DESCRIPTION:**IBM Guardium Data Encryption (GDE) could disclose internal IP address information when the web backend is down.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213863 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Product Name | Component Name
| Affected Version
—|—|—
IBM Guardium Data Encryption (GDE) | Guardium Cloud Key Manager (GCKM) | 1.10.1 and lower
IBM Guardium Data Encryption (GDE) | CipherTrust Tokenization Server (CT-VL) | 2.6.3 and lower
IBM Guardium Data Encryption (GDE) | Guardium Data Encryption Server (DSM) | 4.0.0.7 and lower

Remediation/Fixes

Please apply the fix from below links, to obtain the fixes.
Note: In order to get the fix, customer needs to login to Thales portal.

https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=4f1986971b0e4510b840c84b1d4bcbc4&sysparm_article=KB0025645

Workarounds and Mitigations

None