Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle and Apache MINA SSHD vulnerabilities that may cause denial of service, resource exhaustion, cryptographic verification bypass, or authentication issues.

Security Bulletin

Summary

IBM Tivoli Netcool Configuration Manager version 6.4.2 addresses multiple vulnerabilities in Bouncy Castle and Apache MINA SSHD components. These vulnerabilities could allow attackers to cause denial of service, excessive resource consumption, application crashes, bypass cryptographic verification, or exploit authentication related weaknesses through specially crafted input. Successful exploitation may impact application availability, data integrity, confidentiality, and overall system security.

Vulnerability Details

CVEID: CVE-2026-17508
DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceiling could be evaded entirely; the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2); and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
CVSS Source: bcorg
CVSS Base score: 5.3
CVSS Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)

CVEID: CVE-2026-18036
DESCRIPTION: In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomials r and m during encapsulation, and coefficients recovered during decapsulation. An attacker able to measure that timing can recover information about the NTRU private key. modQ now masks, which is exact because q is always a power of two, and mod3 uses the reference implementation's division-free fold and select; the results are unchanged.
CWE: CWE-208: Observable Timing Discrepancy
CVSS Source: bcorg
CVSS Base score: 8.2
CVSS Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)

CVEID: CVE-2026-97873
DESCRIPTION: In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count from an encoded PKCS12PBEParams or PBEParameter, narrowing a value beyond the int range with intValue(), and every Cipher, Mac and SecretKeyFactory in these families derived with whatever count it was given, including one decoded by another provider's AlgorithmParameters, as when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() decrypts a PKCS#12 PBE-protected private key with BC. Both the parameter parse and the derivations now reject a negative or over-limit count under the org.bouncycastle.pbe.max_iteration_count property (default 10,000,000) that already bounded PBKDF2 (CVE-2026-17508), and the parse rejects a count beyond the int range rather than narrowing it. This issue also affects Bouncy Castle for Java LTS before 2.73.13.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
CVSS Source: bcorg
CVSS Base score: 5.3
CVSS Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)

CVEID: CVE-2026-77185
DESCRIPTION: Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result. Users are recommended to upgrade to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error and which additionally forbid the use of this "asynchronous authentication" mechanism with the public-key or hostbased authentication schemes: if used, the SSH session will be closed and the server will log an entry indicating that asynchronous authentication may be used only with password or keyboard-interactive authentication.
CWE: CWE-305: Authentication Bypass by Primary Weakness
CVSS Source: security@apache.org
CVSS Base score: 9.1
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2026-93994
DESCRIPTION: Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
CWE: CWE-304: Missing Critical Step in Authentication
CVSS Source: security@apache.org
CVSS Base score: 8.1
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Tivoli Netcool Configuration Manager (ITNCM)	6.4.2 GA through 6.4.2.25

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading.

# BouncyCastle Libraries Upgrade - Customer Note

Note:

a. This patch is only to be aplied on top of ITNCM FP25.

b. This patch needs to be applied on all presentation and standalone/linked worker servers.

c. Please use the users with which ncm is installed for applying this patch.

* Replace $INSTALL_DIR with the directory where ITNCM is installed

on your system (e.g /opt/IBM/tivoli/netcool/ncm).

* Replace $JAZZ_PATH in the instructions below with the Jazz Path

directory for your installation (e.g. /opt/IBM/JazzSM).

* Replace $WAS_PATH in the instructions below with the was Path

directory for your installation (e.g. /opt/IBM/WebSphere/AppServer).

1. Download the new library versions from maven repository (https://mvnrepository.com/artifact/org.bouncycastle):

- bcpkix-jdk18on-1.86.jar

- bcprov-jdk18on-1.86.jar

- bcutil-jdk18on-1.86.jar

2. Back up the existing libraries by copying them to a safe location:

cp $INSTALL_DIR/lib/bcpkix-jdk18on-1.85.jar <backup_location>/

cp $INSTALL_DIR/lib/bcprov-jdk18on-1.85.jar <backup_location>/

cp $INSTALL_DIR/lib/bcutil-jdk18on-1.85.jar <backup_location>/

3. Stop all running ITNCM processes by using the "itncm.sh stop" command:

$INSTALL_DIR/bin/itncm.sh stop

4. Copy the new bcpkix-jdk18on-1.86.jar to the following location:

cp bcpkix-jdk18on-1.86.jar $INSTALL_DIR/lib/

5. Copy the new bcutil-jdk18on-1.86.jar to the following location:

cp bcutil-jdk18on-1.86.jar $INSTALL_DIR/lib/

6. Copy the new bcprov-jdk18on-1.86.jar to the following locations:

cp bcprov-jdk18on-1.86.jar $INSTALL_DIR/lib/

cp bcprov-jdk18on-1.86.jar $INSTALL_DIR/compliance/lib/

cp bcprov-jdk18on-1.86.jar $INSTALL_DIR/liberty/lib/

cp bcprov-jdk18on-1.86.jar $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/lib/

cp bcprov-jdk18on-1.86.jar $WAS_PATH/lib/

7. Update the classpath configuration files:

- Edit $INSTALL_DIR/bin/classpath and change:

- bcpkix-jdk18on-1.85.jar to bcpkix-jdk18on-1.86.jar

- bcprov-jdk18on-1.85.jar to bcprov-jdk18on-1.86.jar

- bcutil-jdk18on-1.85.jar to bcutil-jdk18on-1.86.jar

- Edit $INSTALL_DIR/bin/classpath-core and change:

- bcpkix-jdk18on-1.85.jar to bcpkix-jdk18on-1.86.jar

- bcprov-jdk18on-1.85.jar to bcprov-jdk18on-1.86.jar

- bcutil-jdk18on-1.85.jar to bcutil-jdk18on-1.86.jar

8. Remove the old bcpkix-jdk18on-1.85.jar from the following location:

rm -rf $INSTALL_DIR/lib/bcpkix-jdk18on-1.85.jar

9. Remove the old bcutil-jdk18on-1.85.jar from the following location:

rm -rf $INSTALL_DIR/lib/bcutil-jdk18on-1.85.jar

10. Remove the old bcprov-jdk18on-1.85.jar from all locations:

rm -rf $INSTALL_DIR/lib/bcprov-jdk18on-1.85.jar

rm -rf $INSTALL_DIR/compliance/lib/bcprov-jdk18on-1.85.jar

rm -rf $INSTALL_DIR/liberty/lib/bcprov-jdk18on-1.85.jar

rm -rf $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/Intelliden\ R-Series.ear/lib/bcprov-jdk18on-1.85.jar

rm -rf $WAS_PATH/lib/bcprov-jdk18on-1.85.jar

11. Restart ITNCM by using the "itncm.sh start" command:

$INSTALL_DIR/bin/itncm.sh start

To roll back to the previous versions of BouncyCastle libraries, please stop ITNCM as mentioned in step 3 and restore the backups that you made in step 2 to all the locations mentioned in steps 4, 5, and 6, revert the classpath changes made in step 7, remove the newer version of libraries which were earlier copied in steps 4,5 and 6, then perform step 11 to start ITNCM again.

# Apache Mina and SSHD Libraries Upgrade - Customer Note

Note:

a. If ITNCM is running on a fix pack older than FP25, then it must first be upgraded to FP25, as this patch is intended to be applied only on top of ITNCM FP25.

b. This patch needs to be applied on all presentation and standalone/linked worker servers.

c. Please use the users with which ncm is installed for applying this patch.

* Replace $INSTALL_DIR with the directory where ITNCM is installed

on your system (e.g /opt/IBM/tivoli/netcool/ncm).

* Replace $JAZZ_PATH in the instructions below with the Jazz Path

directory for your installation (e.g. /opt/IBM/JazzSM).

1. Download the new library versions from maven repository:

- sshd-core-2.20.0.jar (https://mvnrepository.com/artifact/org.apache.sshd/sshd-core/2.20.0)

- sshd-common-2.20.0.jar (https://mvnrepository.com/artifact/org.apache.sshd/sshd-common/2.20.0)

2. Back up the existing libraries by copying them to a safe location:

cp $INSTALL_DIR/lib/sshd-core-2.19.0.jar <backup_location>/

cp $INSTALL_DIR/lib/sshd-common-2.19.0.jar <backup_location>/

cp $INSTALL_DIR/autodiscovery/lib/sshd-core-2.19.0.jar <backup_location>/

cp $INSTALL_DIR/autodiscovery/lib/sshd-common-2.19.0.jar <backup_location>/

3. Stop all running ITNCM processes by using the "itncm.sh stop" command:

$INSTALL_DIR/bin/itncm.sh stop

4. Copy the new sshd-core-2.20.0.jar to the following locations:

cp sshd-core-2.20.0.jar $INSTALL_DIR/lib/

cp sshd-core-2.20.0.jar $INSTALL_DIR/autodiscovery/lib/

cp sshd-core-2.20.0.jar $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/IMC.ear/webstart.war/

5. Copy the new sshd-common-2.20.0.jar to the following locations:

cp sshd-common-2.20.0.jar $INSTALL_DIR/lib/

cp sshd-common-2.20.0.jar $INSTALL_DIR/autodiscovery/lib/

cp sshd-common-2.20.0.jar $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/IMC.ear/webstart.war/

6. Update the classpath configuration files:

- Edit $INSTALL_DIR/bin/classpath and change:

- sshd-core-2.19.0.jar to sshd-core-2.20.0.jar

- sshd-common-2.19.0.jar to sshd-common-2.20.0.jar

- Edit $INSTALL_DIR/bin/classpath-core and change:

- sshd-core-2.19.0.jar to sshd-core-2.20.0.jar

- sshd-common-2.19.0.jar to sshd-common-2.20.0.jar

7. Update the webstart configuration files in $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/IMC.ear/webstart.war/

(e.g. /opt/IBM/JazzSM/profile/installedApps/JazzSMNode01Cell/IMC.ear/webstart.war):

a. Edit intelliden-imc-core.jsp and change:

to:

b. Edit version.xml and change:

<version-id>6.4.2.25-2.19</version-id>

</pattern>

</resource>

<name>sshd-common-2.19.0.jar</name>

<version-id>6.4.2.25-2.19</version-id>

</pattern>

<file>sshd-common-2.19.0.jar</file>

</resource>

to:

<version-id>6.4.2.25-2.20</version-id>

</pattern>

</resource>

<name>sshd-common-2.20.0.jar</name>

<version-id>6.4.2.25-2.20</version-id>

</pattern>

<file>sshd-common-2.20.0.jar</file>

</resource>

8. Remove the old sshd-core 2.19.0 jars from all locations:

rm -rf $INSTALL_DIR/lib/sshd-core-2.19.0.jar

rm -rf $INSTALL_DIR/autodiscovery/lib/sshd-core-2.19.0.jar

rm -rf $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/IMC.ear/webstart.war/sshd-core-2.19.0.jar

9. Remove the old sshd-common 2.19.0 jars from all locations:

rm -rf $INSTALL_DIR/lib/sshd-common-2.19.0.jar

rm -rf $INSTALL_DIR/autodiscovery/lib/sshd-common-2.19.0.jar

rm -rf $JAZZ_PATH/profile/installedApps/JazzSMNode01Cell/IMC.ear/webstart.war/sshd-common-2.19.0.jar

10. Restart ITNCM by using the "itncm.sh start" command:

$INSTALL_DIR/bin/itncm.sh start

11. Clear the compiled JSP classes from the Jazz temp directory:

cd $JAZZ_PATH/profile/temp/JazzSMNode01/server1/IMC/webstart.war/

rm -rf *.class

Then clear the Java Web Start cache on the client machine, download admin.jnlp freshly and launch NCM.

To roll back to the previous versions of jars, please stop ITNCM as mentioned in step 3 and restore the backups that you made in step 2 to all the locations mentioned in steps 4 and 5, revert the classpath changes made in step 6, revert the intelliden-imc-core.jsp and version.xml changes made in step 7, remove the newer version of libraries which were earlier copied in steps 4 and 5, then perform steps 10 and 11 to start ITNCM again.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Acknowledgement

Change History

31 Oct 2026: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

Document Location

Worldwide

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SS7UH9","label":"Tivoli Netcool Configuration Manager"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF051","label":"Linux on IBM Z Systems"}],"Version":"6.4.2","Edition":"","Line of Business":{"code":"LOB77","label":"Automation Platform"}}]

Was this topic helpful?

Document Information

Modified date:
31 October 2026

Initial Publish date:
31 October 2026

UID

ibm17294999

Tips

Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle and Apache MINA SSHD vulnerabilities that may cause denial of service, resource exhaustion, cryptographic verification bypass, or authentication issues.