IBM Security Verify Governance Cryptographic Hash Vulnerability in Identity Manager

A vulnerability exists in IBM Security Verify Governance 10.0.2 Identity Manager, where a one-way cryptographic hash is applied to inputs like passwords without the use of a salt. This omission can make the hashing process reversible, potentially allowing for the original input to be retrieved.

Impact

The lack of salting in the hashing process could lead to vulnerabilities such as rainbow table attacks, where an attacker precomputes hash values to reverse-engineer hashed inputs like passwords.

Remediation

Users are advised to update to version 10.0.2.0-ISS-ISVG-IGVA-FP0004, available through the IBM Support Fix Central.