CVE-2022-40234: IBM Spectrum Protect Plus

Описание

Оригинално описание

Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.

Засегнати продукти

• IBM Spectrum Protect Plus: 10.1.0; 10.1.11

История

Други уязвимости в IBM Spectrum Protect Plus

• 6.8CVE-2020-4497
• 5.9CVE-2022-40608
• 6.0CVE-2022-22472
• 6.8CVE-2022-22396
• 6.2CVE-2022-22354

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-40234
• https://nvd.nist.gov/vuln/detail/CVE-2022-40234
• https://www.ibm.com/support/pages/node/6619947
• https://exchange.xforce.ibmcloud.com/vulnerabilities/235718