CVE-2018-15769
high-risk
Published 2018-11-16
RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue. A malicious TLS server could potentially cause a Denial Of Service (DoS) on TLS clients during the handshake when a very large prime value is sent to the TLS client, and an Ephemeral or Anonymous Diffie-Hellman cipher suite (DHE or ADH) is used.
Do I need to act?
~
1.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Products (20)
Bsafe
Core Rdbms
Core Rdbms
Core Rdbms
Core Rdbms
Core Rdbms
Real User Experience Insight
Real User Experience Insight
Real User Experience Insight
References (16)
Broken Link
http://www.securityfocus.com/bid/105929
Broken Link
http://www.securitytracker.com/id/1042057
Mailing List
https://seclists.org/fulldisclosure/2018/Nov/37
Broken Link
http://www.securityfocus.com/bid/105929
Broken Link
http://www.securitytracker.com/id/1042057
Mailing List
https://seclists.org/fulldisclosure/2018/Nov/37
51
/ 100
high-risk
Severity
26/34 · High
Exploitability
4/34 · Minimal
Exposure
21/34 · High