CVE-2019-6157 Information disclosure in System x
Lenovo System x firmware logs expose the web server's private key in support files, allowing attackers to decrypt traffic or impersonate the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6157?
CVE-2019-6157 is a medium-severity vulnerability in Lenovo System x, published on 22 Apr 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.
Weakness: CWE-532
Which versions are affected by CVE-2019-6157?
It affects 42 products.
Products include Ibm Bladecenter Hs22 Firmware, Ibm Bladecenter Hs23 Firmware, Ibm Bladecenter Hs23e Firmware, Ibm Flex System X220 M4 Firmware, Ibm Flex System X222 M4 Firmware, Ibm Flex System X240 M4 Firmware and 36 more.
How do I fix CVE-2019-6157?
No fix has been published for CVE-2019-6157 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-6157 being exploited?
There is no known exploitation of CVE-2019-6157 in the wild and no public exploit code.
Other vulnerabilities in Lenovo System x
Sources
Also known as GHSA-jmrg-wp7g-g3wc.