Description
Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Spectrum Protect Plus | 10.1.0, 10.1.11 | — |
Advisories 1
- WID-SEC-2022-1461 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 20, 2023