Vulnerability CVE-2018-1665

Vulnerability Name:

CVE-2018-1665 (CCN-144891)

Assigned:

2017-12-13

Published:

2018-12-11

Updated:

2019-10-09

Summary:

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-326

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2018-1665

Source: CCN
Type: IBM Security Bulletin 744195 (DataPower Gateway)
IBM DataPower Gateway is affected by a vulnerability (CVE-2018-1665)

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10744195

Source: XF
Type: UNKNOWN
ibm-websphere-cve20181665-info-disc(144891)

Source: XF
Type: VDB Entry, Vendor Advisory
ibm-websphere-cve20181665-info-disc(144891)

Source: CCN
Type: IBM Security Bulletin 739239 (MQ Appliance)
IBM MQ Appliance is affected by weak cryptographic algorithms (CVE-2018-1665)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:datapower_gateway:*:*:*:*:*:*:*:* (Version >= 7.5.0.0 and <= 7.5.0.18)

OR cpe:/a:ibm:datapower_gateway:*:*:*:*:*:*:*:* (Version >= 7.5.1.0 and <= 7.5.1.17)

OR cpe:/a:ibm:datapower_gateway:*:*:*:*:*:*:*:* (Version >= 7.5.2.0 and <= 7.5.2.17)

OR cpe:/a:ibm:datapower_gateway:*:*:*:*:*:*:*:* (Version >= 7.6.0.0 and <= 7.6.0.10)

OR cpe:/a:ibm:datapower_gateway:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and <= 7.7.1.3)

Configuration CCN 1:

cpe:/a:ibm:datapower_gateway:7.6.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:datapower_gateway:7.5.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:datapower_gateway:7.5.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:datapower_gateway:7.5.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:datapower_gateway:7.7.0.0:*:*:*:continuous_delivery:*:*:*

OR cpe:/a:ibm:datapower_gateway:7.7.1.3:*:*:*:continuous_delivery:*:*:*

Denotes that component is vulnerable

BACK