Security Bulletin:A vulnerability in GSKit and GSKit-Crypto affects IBM Performance Management products (CVE-2018-1447)

Summary

A vulnerability in GSKit and GSKit-Crypto affects IBM Performance Management products. The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action.

Vulnerability Details

CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action.

CVSS Base Score: 5.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/139972&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM Monitoring 8.1.3
IBM Advanced Diagnostics 8.1.3
IBM Application Performance Management 8.1.3
IBM Application Performance Management Advanced 8.1.3
IBM Application Performance Management, Base Private 8.1.4
IBM Application Performance Management, Advanced Private 8.1.4

Remediation/Fixes

Product

| Product
VRMF | Remediation
—|—|—
IBM Monitoring

IBM Application Diagnostics
IBM Application Performance Management
IBM Application Performance Management Advanced

| 8.1.3

| The vulnerabilities can be remediated by applying the following 8.1.3.0-IBM-IPM-SERVER-IF0012 server patch to the system where the Performance Management server is installed: http://www-01.ibm.com/support/docview.wss?rs=0&uid=isg400003854
IBM Cloud Application Performance Management Base Private

IBM Cloud Application Performance Management Advanced Private

| 8.1.4 | The vulnerability can be remediated by applying the following 8.1.4.0-IBM-APM-SERVER-IF0004 server patch to the system where the Cloud APM server is installed: http://www-01.ibm.com/support/docview.wss?rs=0&uid=isg400003783

Workarounds and Mitigations

None