full-disclosure - [FD] CA20171114-01: Security Notice for CA Identity Governance

Open Source and information security mailing list archives

Message-ID: <CY4PR01MB2310BE5E53CE00A5E16EBCB384290@CY4PR01MB2310.prod.exchangelabs.com>
Date: Wed, 15 Nov 2017 01:33:19 +0000
From: "Kotas, Kevin J" <Kevin.Kotas@...com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CA20171114-01: Security Notice for CA Identity Governance

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CA20171114-01: Security Notice for CA Identity Governance

Issued: November 14, 2017
Last Updated: November 14, 2017

CA Technologies support is alerting customers to a potential risk
with CA Identity Governance. A vulnerability exists that can
potentially allow a malicious actor to conduct cross-site scripting
attacks. CA published a solution to resolve the issue.

The vulnerability, CVE-2017-9394, occurs due to insufficient input
validation that can result in a stored cross-site scripting
vulnerability. The vulnerability can allow an authenticated remote
attacker to display HTML or execute script in the context of another
user.

Risk Rating

Medium

Platform(s)

All Server Environments where CA Identity Governance can be deployed.
Please refer to the Platform Support Matrix in the product
documentation at https//docops.ca.com

Affected Products

CA Identity Governance 12.6

Note: CA Identity Governance (formerly GovernanceMinder) releases
prior to 12.6 are no longer supported

Unaffected Products

CA Identity Governance 14.0, 14.1

How to determine if the installation is affected

Use the web interface to determine the version and check the version
against the affected products list.

Solution

CA Identity Governance 12.6.5:
Update to CA Identity Governance 12.6.5 CR1 CP3 - RS98844

CA Identity Governance releases previous to 12.6.5:
Open a support ticket to request a hotfix

References

CVE-2017-9394 - CA Identity Governance stored XSS

Acknowledgement

CVE-2017-9394 - Jake Miller of Blue Canopy - A Jacobs company

Change History

Version 1.0: Initial Release

If additional information is required, please contact CA Technologies
Support at https://support.ca.com/

If you discover a vulnerability in CA Technologies products, please
report your findings to CA Technologies Product Vulnerability
Response at vuln <AT> ca.com

Security Notices and PGP key
support.ca.com/irj/portal/anonymous/phpsbpldgpg
www.ca.com/us/support/ca-support-online/documents.aspx?id=177782

Regards,

Kevin Kotas
Vulnerability Response Director
CA Technologies Product Vulnerability Response

Copyright (c) 2017 CA. 520 Madison Avenue, 22nd Floor, New York, NY
10022.  All other trademarks, trade names, service marks, and logos
referenced herein belong to their respective companies.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives