Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMB1E59CCCA8B3CF5EC7706FD13D0C0D0BAE04DA264E9776524A394476D0F03BEB
HistoryAug 11, 2023 - 6:06 a.m.

Security Bulletin: App Connect Professional is affected by Bouncy Castle vulnerability.

2023-08-1106:06:22
www.ibm.com
11
app connect professional
bouncy castle
vulnerability
x.500 name
java
information disclosure
ldap
injection
fix
ibm
patch

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

36.4%

JSON

Summary

App Connect Professional have addressed the following vulnerability reported in Bouncy Castle.

Vulnerability Details

CVEID:CVE-2023-33201
**DESCRIPTION:**The Bouncy Castle Crypto Package For Java (bc-java) could allow a remote attacker to obtain sensitive information, caused by not validating the X.500 name of any certificate in the implementation of the X509LDAPCertStoreSpi.java class. By using blind LDAP injection attack techniques, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 7.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/258653 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
App connect professional v755

Remediation/Fixes

Affected Product Version(s) APAR Fixcentral LinK
App Connect Professional 7.5.5.0 LI83013 7550 Fixcentral link

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmapp_connect_professionalMatch755
OR
ibmapp_connect_professionalMatch021
VendorProductVersionCPE
ibmapp_connect_professional755cpe:2.3:a:ibm:app_connect_professional:755:*:*:*:*:*:*:*
ibmapp_connect_professional021cpe:2.3:a:ibm:app_connect_professional:021:*:*:*:*:*:*:*

Related

osv 8
cgr 1
ibm 34
cvelist 1
redhat 17
cve 1
nessus 13
wolfi 1
veracode 1
debian 1
prion 1
github 2
nvd 1
debiancve 1
ubuntucve 1
openvas 2
redhatcve 1
oracle 4
osv
osv
Bouncy Castle For Java LDAP injection vulnerability
2023-07-05 03:30:23
CVE-2023-33201
2023-07-05 03:15:09
bouncycastle-1.74-1.1 on GA media
2024-06-15 00:00:00
cgr
cgr
CVE-2023-33201 vulnerabilities
2024-05-19 03:07:16
ibm
ibm
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands may be vulnerable to loss of confidentiality
2023-09-28 15:39:04
Security Bulletin: Vulnerability with bcprov-jdk affect IBM Cloud Object Storage Systems (Sept2023)
2023-09-25 20:55:33
Security Bulletin: The Bouncy Castle Crypto Package For Java (bc-java) component is vulnerable to CVE-2023-33201 is used by IBM Maximo Application Suite
2023-09-27 14:14:24
cvelist
cvelist
CVE-2023-33201
2023-07-05 00:00:00
redhat
redhat
(RHSA-2024:0278) Moderate: Red Hat AMQ Broker 7.11.5 release and security update
2024-01-17 13:21:12
(RHSA-2023:7483) Important: Red Hat Single Sign-On 7.6.6 security update on RHEL 8
2023-11-24 16:48:49
(RHSA-2023:7482) Important: Red Hat Single Sign-On 7.6.6 security update on RHEL 7
2023-11-24 16:48:38
cve
cve
CVE-2023-33201
2023-07-05 03:15:09
nessus
nessus
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : bouncycastle (SUSE-SU-2023:2843-1)
2023-07-18 00:00:00
Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2023-280)
2023-08-14 00:00:00
Debian DLA-3514-1 : bouncycastle - LTS security update
2023-08-02 00:00:00
wolfi
wolfi
CVE-2023-33201 vulnerabilities
2024-09-30 03:53:08
veracode
veracode
LDAP Injection
2023-07-06 02:33:48
debian
debian
[SECURITY] [DLA 3514-1] bouncycastle security update
2023-08-02 11:23:42
prion
prion
Design/Logic Flaw
2023-07-05 03:15:00
github
github
Bouncy Castle For Java LDAP injection vulnerability
2023-07-05 03:30:23
mTLS: When certificate authentication is done wrong
2023-08-17 21:22:26
nvd
nvd
CVE-2023-33201
2023-07-05 03:15:09
debiancve
debiancve
CVE-2023-33201
2023-07-05 03:15:09
ubuntucve
ubuntucve
CVE-2023-33201
2023-07-05 00:00:00
openvas
openvas
Debian: Security Advisory (DLA-3514-1)
2023-08-03 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:2843-1)
2023-07-17 00:00:00
redhatcve
redhatcve
CVE-2023-33201
2023-06-29 16:28:41
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

36.4%

JSON
Related for B1E59CCCA8B3CF5EC7706FD13D0C0D0BAE04DA264E9776524A394476D0F03BEB
osv8cgr1ibm34cvelist1redhat17cve1nessus13wolfi1veracode1debian1prion1github2nvd1debiancve1ubuntucve1openvas2redhatcve1oracle4