IBM Semeru Runtime up to 8.0.392.0/11.0.21.0/17.0.9.0/21.0.1.0 risky encryption

Summaryinfo

A vulnerability was found in IBM Semeru Runtime up to 8.0.392.0/11.0.21.0/17.0.9.0/21.0.1.0. It has been declared as problematic. The impacted element is an unknown function. The manipulation results in risky encryption. This vulnerability is reported as CVE-2024-22361. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM Semeru Runtime up to 8.0.392.0/11.0.21.0/17.0.9.0/21.0.1.0. It has been classified as problematic. Affected is some unknown processing. The manipulation with an unknown input leads to a risky encryption vulnerability. CWE is classifying the issue as CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. This is going to have an impact on confidentiality. CVE summarizes:

IBM Semeru Runtime 8.0.302.0 through 8.0.392.0, 11.0.12.0 through 11.0.21.0, 17.0.1.0 - 17.0.9.0, and 21.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 281222.

The weakness was disclosed 02/10/2024. The advisory is shared for download at ibm.com. This vulnerability is traded as CVE-2024-22361 since 01/08/2024. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (281222). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• IBM

Name

• Semeru Runtime

Version

• 8.0.392
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.0.10
• 11.0.11
• 11.0.12
• 11.0.13
• 11.0.14
• 11.0.15
• 11.0.16
• 11.0.17
• 11.0.18
• 11.0.19
• 11.0.20
• 11.0.21.0
• 17.0.0
• 17.0.1
• 17.0.2
• 17.0.3
• 17.0.4
• 17.0.5
• 17.0.6
• 17.0.7
• 17.0.8
• 17.0.9.0
• 21.0.0
• 21.0.1.0

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion