CVE-2018-11058
published 2018-09-14CVE-2018-11058: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.01%
89.4th percentile
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would result in such issue.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dell | bsafe | >= 4.0.0 < 4.0.11 | 4.0.11 |
| dell | bsafe | >= 4.1.0 < 4.1.6 | 4.1.6 |
| dell | bsafe_crypto-c | >= 4.0.0 < 4.0.5.3 | 4.0.5.3 |
| oracle | application_testing_suite | — | — |
| oracle | communications_analytics | — | — |
| oracle | communications_ip_service_activator | — | — |
| oracle | communications_ip_service_activator | — | — |
| oracle | core_rdbms | — | — |
| oracle | core_rdbms | — | — |
| oracle | core_rdbms | — | — |
| oracle | core_rdbms | — | — |
| oracle | core_rdbms | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | goldengate_application_adapters | — | — |
| oracle | jd_edwards_enterpriseone_tools | — | — |
| oracle | real_user_experience_insight | — | — |
| oracle | real_user_experience_insight | — | — |
| oracle | real_user_experience_insight | — | — |
| oracle | retail_predictive_application_server | — | — |
| oracle | retail_predictive_application_server | — | — |
| oracle | security_service | — | — |
| oracle | security_service | — | — |
| oracle | security_service | — | — |
| oracle | timesten_in-memory_database | < 18.1.4.1.0 | 18.1.4.1.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_oracle9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6pm8-q9vc-vxxj: RSA BSAFE Micro Edition Suite, versions prior to 4
ghsa_unreviewed·2022-05-13
CVE-2018-11058 [CRITICAL] CWE-125 GHSA-6pm8-q9vc-vxxj: RSA BSAFE Micro Edition Suite, versions prior to 4
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would result in such issue.
Oracle
Oracle Oracle TimesTen In-Memory Database Risk Matrix: EM TimesTen plugin (RSA BSAFE Crypto-C) — CVE-2018-11058
vendor_oracle·2020-10-15·CVSS 9.8
CVE-2018-11058 [CRITICAL] Oracle Oracle TimesTen In-Memory Database Risk Matrix: EM TimesTen plugin (RSA BSAFE Crypto-C) — CVE-2018-11058
Oracle Oracle TimesTen In-Memory Database Risk Matrix: EM TimesTen plugin (RSA BSAFE Crypto-C) vulnerability
CVE: CVE-2018-11058
CVSS: 9.8
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Platform (RSA BSAFE) — CVE-2018-11058
vendor_oracle·2020-07-15·CVSS 9.8
CVE-2018-11058 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: Platform (RSA BSAFE) — CVE-2018-11058
Oracle Oracle Communications Applications Risk Matrix: Platform (RSA BSAFE) vulnerability
CVE: CVE-2018-11058
CVSS: 9.8
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2020 (JUL 2020)
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Processing (Oracle Instant Client) — CVE-2018-11058
vendor_oracle·2020-04-15·CVSS 8.8
CVE-2018-11058 [CRITICAL] Oracle Oracle Enterprise Manager Risk Matrix: Processing (Oracle Instant Client) — CVE-2018-11058
Oracle Oracle Enterprise Manager Risk Matrix: Processing (Oracle Instant Client) vulnerability
CVE: CVE-2018-11058
CVSS: 8.8
Protocol: Multiple
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2020 (APR 2020)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Database Client (NZ) — CVE-2018-11058
vendor_oracle·2020-01-15·CVSS 9.8
CVE-2018-11058 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: Database Client (NZ) — CVE-2018-11058
Oracle Oracle Communications Applications Risk Matrix: Database Client (NZ) vulnerability
CVE: CVE-2018-11058
CVSS: 9.8
Protocol: TCPS/HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2020 (JAN 2020)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2018/Aug/46http://www.securityfocus.com/bid/108106https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttp://seclists.org/fulldisclosure/2018/Aug/46http://www.securityfocus.com/bid/108106https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
2018-09-14
Published