CVE-2017-1319: Weak Encryption
Published Jun 8, 2017
·Updated
IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookie. IBM X-Force ID: 125731.
Affected Software
3 affected components
IBM Tivoli Federated Identity Manager=6.2.0
IBM Tivoli Federated Identity Manager=6.2.1
IBM Tivoli Federated Identity Manager=6.2.2
Remediation
Patch Available
Event History
Jun 8, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-1319?
CVE-2017-1319 is classified as a medium-severity vulnerability due to the lack of secure attributes in SSL cookies.
2
How do I fix CVE-2017-1319?
To fix CVE-2017-1319, ensure that secure attributes are added to encrypted session cookies in IBM Tivoli Federated Identity Manager.
3
Which versions of IBM Tivoli Federated Identity Manager are affected by CVE-2017-1319?
CVE-2017-1319 affects version 6.2.0, 6.2.1, and 6.2.2 of IBM Tivoli Federated Identity Manager.
4
What impact does CVE-2017-1319 have on users?
CVE-2017-1319 may allow an attacker to exploit insecure cookies, potentially leading to session hijacking.
5
Is there a workaround for CVE-2017-1319?
Currently, the recommended approach for CVE-2017-1319 is to apply the necessary updates that include secure cookie configurations.