IBM Verify Identity Access and IBM Security Verify Access Reverse Proxy HTTP Request Smuggling Vulnerability

A vulnerability exists in IBM Verify Identity Access Container versions 11.0 through 11.0.2, IBM Security Verify Access Container versions 10.0 through 10.0.9.1, IBM Verify Identity Access versions 11.0 through 11.0.2, and IBM Security Verify Access versions 10.0 through 10.0.9.1. This vulnerability could allow a remote attacker to access sensitive information by exploiting an inconsistent interpretation of an HTTP request by a reverse proxy.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information.

Remediation

Users are encouraged to update to IBM Verify Identity Access v11.0.2 IF1 or IBM Security Verify Access v10.0.9.1 IF1. Instructions for downloading these versions are available on the IBM Support Fix Central website. For container users, the latest version can be downloaded from the IBM Security Verify Access documentation site.