CVE-2020-4188 Weak cryptography in Security Guardium

Medium 5.3 Published 23 Jun 2020 Updated 17 Sep 2024

IBM Security Guardium uses insufficiently random numbers, potentially allowing attackers to bypass security controls dependent on unpredictability.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-4188?

CVE-2020-4188 is a medium-severity vulnerability in Ibm Security Guardium, published on 23 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security context that depends on unpredictable numbers. IBM X-Force ID: 174807.

Weakness: CWE-330

Which versions are affected by CVE-2020-4188?

It affects 1 product.

Products include Ibm Security Guardium.

How do I fix CVE-2020-4188?

No fix has been published for CVE-2020-4188 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-4188 being exploited?

There is no known exploitation of CVE-2020-4188 in the wild and no public exploit code.

All Ibm Security Guardium vulnerabilities

Sources

Also known as GHSA-h485-v848-pjpp.