IBM Security Bulletin: IBM Security Key Lifecycle Manager is affected by XML External Entity Injection (XXE) attack (CVE-2017-1666)
IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVE(s): CVE-2017-1666
Affected product(s) and affected version(s):
IBM Security Key Lifecycle Manager: v2.5 – 2.5.0.8
IBM Security Key Lifecycle Manager v2.6 – 2.6.0.3
IBM Security Key Lifecycle Manager: v2.7 – 2.7.0.2
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2lUTlIq
X-Force Database: http://ift.tt/2CISswW
The post IBM Security Bulletin: IBM Security Key Lifecycle Manager is affected by XML External Entity Injection (XXE) attack (CVE-2017-1666) appeared first on IBM PSIRT Blog.
from IBM Product Security Incident Response Team http://ift.tt/2lXweNp