Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-1504: IBM WebSphere Application Server allows weak AES encryption

CVE-2017-1504 · published 9 years ago

Summary

The WebSphere Application Server version 9.0.0.4 can produce weaker-than-expected encryption when the PasswordUtil tool is used to enable AES protection. This may let attackers more easily decode stored passwords. Stop using PasswordUtil for AES encryption or apply the recommended update that restores proper security settings.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	websphere_application_server	9.0.0.4 `cpe:2.3:a:ibm:websphere_application_server:9.0.0.4:::::::*`

Original advisory text

IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable AES password encryption. IBM X-Force ID: 129579.

References

http://www.ibm.com/support/docview.wss?uid=swg22006803 Permissions Required Vendor Advisory
http://www.securityfocus.com/bid/100137
https://exchange.xforce.ibmcloud.com/vulnerabilities/129579 VDB Entry Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published3 Aug 2017

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-1504 · NVD

Track software like this

Free during beta