Security Bulletin
Summary
WebSphere Application Server traditional 9.0.0.4 added a new feature using the PasswordUtil command to enable AES password encryption. If you used this feature, then you have a potential for weaker than expected security since some passwords did not get encrypted as you might have expected. If you didn't use this new feature, then you are not affected by this vulnerability. This does not affect passwords with the default XOR encoding, or passwords with custom encryption.
Vulnerability Details
Consult the security bulletin: Weaker than expected security in WebSphere Application Server for vulnerability details and information about fixes.
Affected Products and Versions
This vulnerability affects the following versions and releases of IBM WebSphere Application Server:
- Version 9.0.0.4 - if you used the PasswordUtil command to enable AES password encryption.
Get Notified about Future Security Bulletins
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg22007302