Vulnerabilities > CVE-2021-38979 - Use of Password Hash With Insufficient Computational Effort vulnerability in IBM products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

ibm

CWE-916

NVD

Published: 2021-11-15

Updated: 2022-07-12

Summary

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 212785.

Vulnerable Configurations

Part	Description	Count
Application	Ibm IBM Security Guardium KEY Lifecycle Manager 4.1.0 IBM Security Guardium KEY Lifecycle Manager 4.1.0.1 IBM Security Guardium KEY Lifecycle Manager 4.1.1 IBM Security KEY Lifecycle Manager 3.0 IBM Security KEY Lifecycle Manager 3.0.0 IBM Security KEY Lifecycle Manager 3.0.0.1 IBM Security KEY Lifecycle Manager 3.0.0.2 IBM Security KEY Lifecycle Manager 3.0.0.3 IBM Security KEY Lifecycle Manager 3.0.1 IBM Security KEY Lifecycle Manager 3.0.1.1 IBM Security KEY Lifecycle Manager 3.0.1.2 IBM Security KEY Lifecycle Manager 3.0.1.3 IBM Security KEY Lifecycle Manager 4.0 IBM Security KEY Lifecycle Manager 4.0.0.2 IBM Security KEY Lifecycle Manager 4.1.0 IBM Security KEY Lifecycle Manager 4.1.0.1 IBM Security KEY Lifecycle Manager 4.1.1	17
OS	Ibm IBM AIX -	1
OS	Linux Linux Linux Kernel -	1
OS	Microsoft Microsoft Windows -	1

Common Weakness Enumeration (CWE)

CWE-916 - Use of Password Hash With Insufficient Computational Effort

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References