5.1
Medium
CVE-2018-1447 The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic…
Description
The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spectrum Protect | 8.1 | No fix stated |
| Spectrum Protect | 7.1 | No fix stated |
| Spectrum Protect Snapshot 4.1 | 4.1.3 → 4.1.6 | No fix stated |
| Spectrum Protect for Virtual Environments | 8.1 | No fix stated |
| Spectrum Protect for Virtual Environments | 7.1 | No fix stated |
| Spectrum Protect for Space Management | 8.1 | No fix stated |
| Spectrum Protect for Space Management | 7.1 | No fix stated |
Other CVEs of Spectrum Protect
The 23 CVEs of Spectrum Protect →
CVE-2021-39048
IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds…
6.2
Medium
CVE-2020-4559
IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of…
5.9
Medium
CVE-2020-4415
IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds…
9.8
Critical
CVE-2019-4267
The IBM Spectrum Protect 7.1 and 8.1 Backup-Archive Client is vulnerable to a buffer overflow
4.9
Medium