CVE-2018-1466
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could…
Does this matter?
Lower severity and a low EPSS score (0.83%). Track it; it rarely justifies an emergency change on its own.
Description
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.83% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-326
- Affected
- ibm/storwize v7000 firmware · ibm/storwize v5000 firmware · ibm/storwize v3700 firmware · ibm/storwize v3500 firmware · ibm/storwize v9000 firmware · ibm/san volume controller firmware · ibm/spectrum virtualize · ibm/spectrum virtualize for public cloud
- Source
- psirt@us.ibm.com
References
- http://www.ibm.com/support/docview.wss?uid=ssg1S1012263Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=ssg1S1012282Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=ssg1S1012283Vendor Advisory
- http://www.securityfocus.com/bid/104349Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/140397VDB Entry, Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=ssg1S1012263Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=ssg1S1012282Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=ssg1S1012283Vendor Advisory
- http://www.securityfocus.com/bid/104349Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/140397VDB Entry, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.