IBMEE29886349A2F4B3F9470583E36779127DC3D2D6082D18CD8D506B1B8C2597FDSecurity Bulletin: IBM Guardium Data Encryption is vulnerable to missing data encoding issue (CVE-2021-39027)
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
0.0005 Low
EPSS
Percentile
17.2%
Summary
A vulnerability was identified in IBM Guardium Data Encryption (GDE). Please apply the latest version for the fixes.
Vulnerability Details
CVEID:CVE-2021-39027
**DESCRIPTION:**IBM Guardium Data Encryption (GDE) prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS Base score: 3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213865 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N)
Affected Products and Versions
| Product Name | Component Name | Affected Version |
|---|---|---|
| IBM Guardium Data Encryption (GDE) | CipherTrust Tokenization Server (CT-VL) | CT-VL 2.6.4.21 |
Remediation/Fixes
IBM encourages customers to promptly update their systems.
Obtain the fixes using the link below.
Note: In order to get the fix, customer needs to login to Thales portal.
| Component Name | Fixed in version | Patch/Upgrade link |
|---|---|---|
| CipherTrust Tokenization Server (CT-VL) | 2.6.5.98 | https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=b417ffe4c3938d905626176ce0013181&sysparm_article=KB0025821 |
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm security guardium data encryption | eq | 4.0.0. | |
| ibm security guardium data encryption | eq | 5.0.0. |
Related
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
0.0005 Low
EPSS
Percentile
17.2%