IBM Verify Identity Access and IBM Security Verify Access Cryptographic Vulnerability Allowing Decryption of Sensitive Information

A vulnerability exists in IBM Verify Identity Access Container versions 11.0 through 11.0.2, IBM Security Verify Access Container versions 10.0 through 10.0.9.1, IBM Verify Identity Access versions 11.0 through 11.0.2, and IBM Security Verify Access versions 10.0 through 10.0.9.1. These products use cryptographic algorithms that are weaker than expected, potentially allowing an attacker to decrypt highly sensitive information.

Impact

Exploitation of this vulnerability could lead to the unauthorized decryption of sensitive information, potentially exposing confidential data.

Remediation

Users are advised to update to IBM Verify Identity Access version 11.0.2 IF1 or IBM Security Verify Access version 10.0.9.1 IF1. Instructions for downloading these versions are available on the IBM Support Fix Central website. For container users, the updated version can be downloaded from the IBM Security Verify Access documentation site.