CVE-2021-38984: Weak Encryption
First published: Thu Nov 11 2021(Updated: )
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 212793.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Guardium Key Lifecycle Manager | >=4.1.0<=4.1.0.1 | |
| IBM Security Guardium Key Lifecycle Manager | =4.1.1 | |
| Ibm Security Key Lifecycle Manager | >=3.0<=3.0.0.4 | |
| Ibm Security Key Lifecycle Manager | >=3.0.1<=3.0.1.5 | |
| Ibm Security Key Lifecycle Manager | >=4.0<=4.0.0.3 | |
| Ibm Security Key Lifecycle Manager | <=3.0 - 3.0.0.4 | |
| Ibm Security Key Lifecycle Manager | <=3.0.1 - 3.0.1.5 | |
| Ibm Security Key Lifecycle Manager | <=4.0 - 4.0.0.3 | |
| IBM Security Guardium Key Lifecycle Manager | <=4.1.0 - 4.1.0.1 | |
| IBM Security Guardium Key Lifecycle Manager | <=4.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-38984?
CVE-2021-38984 is a vulnerability in IBM Tivoli Key Lifecycle Manager that allows an attacker to decrypt highly sensitive information.
Which versions of IBM Tivoli Key Lifecycle Manager are affected?
IBM Tivoli Key Lifecycle Manager versions 3.0, 3.0.1, 4.0, and 4.1 are affected.
How can the vulnerability in IBM Tivoli Key Lifecycle Manager be exploited?
The vulnerability in IBM Tivoli Key Lifecycle Manager can be exploited by using weaker than expected cryptographic algorithms.
What is the severity of CVE-2021-38984?
The severity of CVE-2021-38984 is high with a CVSS score of 7.5.
Is there a fix available for CVE-2021-38984?
IBM has provided a fix for the vulnerability in IBM Tivoli Key Lifecycle Manager. Please refer to the IBM support page for more information.
- collector/nvd-index
- agent/references
- agent/type
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/remedy
- agent/author
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- vendor/ibm
- canonical/ibm security guardium key lifecycle manager
- version/ibm security guardium key lifecycle manager/4.1.0
- version/ibm security guardium key lifecycle manager/4.1.0.1
- version/ibm security guardium key lifecycle manager/4.1.1
- canonical/ibm security key lifecycle manager
- version/ibm security key lifecycle manager/3.0
- version/ibm security key lifecycle manager/3.0.0.4
- version/ibm security key lifecycle manager/3.0.1
- version/ibm security key lifecycle manager/3.0.1.5
- version/ibm security key lifecycle manager/4.0
- version/ibm security key lifecycle manager/4.0.0.3
- version/ibm security key lifecycle manager/3.0 - 3.0.0.4
- version/ibm security key lifecycle manager/3.0.1 - 3.0.1.5
- version/ibm security key lifecycle manager/4.0 - 4.0.0.3
- version/ibm security guardium key lifecycle manager/4.1.0 - 4.1.0.1