CVE-2020-4965 — Use of a Broken or Risky Cryptographic Algorithm in IBM Rational Team Concert

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm CWE-326 — Inadequate Encryption Strength3 documents3 sources

Severity

7.5HIGHNVD

EPSS

0.1%

top 70.54%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Engineering Lifecycle Optimization IBM Engineering Test Management IBM Engineering Workflow Management +13 more

Timeline

PublishedApr 12

Latest updateMay 24

Description

IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages21 packages

▶CVEListV5ibm/rational_team_concert6.0.2, 6.0.6, 6.0.6.1+2

▶NVDibm/rational_team_concert6.0.2, 6.0.6, 6.0.6.1+2

▶NVDibm/doors_next7.0.0, 7.0.1, 7.0.2+2

▶NVDibm/engineering_insights7.0.0, 7.0.1, 7.0.2+2

▶NVDibm/rhapsody_model_manager6.0.2, 6.0.6, 6.0.6.1+2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-pxx3-r5wf-5fr5: IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information↗2022-05-24

▶

CVEList

CVE-2020-4965: IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information↗2021-04-12

▶