Security Bulletin: Hazardous input validation in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38985)

Summary

Hazardous input validation in IBM Security Guardium Key Lifecycle Manager (CVE-2021-38985).

Vulnerability Details

CVEID:CVE-2021-38985
**DESCRIPTION:**IBM Tivoli Key Lifecycle Manager receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/212799 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM Security Key Lifecycle Manager| 3.0.1 - 3.0.1.5

IBM Security Key Lifecycle Manager| 4.0 - 4.0.0.3

IBM Security Guardium Key Lifecycle Manager
| 4.1.0 - 4.1.0.1

IBM Security Guardium Key Lifecycle Manager| 4.1.1

Remediation/Fixes

It is fixed in 4.1.1 - Fix Pack 1

Workarounds and Mitigations

None