Security Bulletin: IBM Security Verify Information Queue displays the Grafana signing key when setting up the logs stack (CVE-2021-20412)

Summary IBM Security Verify Information Queue ISIQ offers an optional logs stack to demonstrate logging and monitoring. Among the stack's components is a Grafana dashboard. The initialization file for Grafana contains a hard-coded signing key. As of ISIQ v10.0.0, this signing key has been removed...

CVE-2021-20412

CVE-2021-20412 affects IBM Security Verify Information Queue (ISIQ) 1.0.6 and 1.0.7, where a hard-coded credential (a signing key for Grafana in the logs stack) is stored in the Grafana initialization file. The IBM security bulletin confirms the presence of hard-coded credentials and notes the si...