CVE-2021-20419: 
IBM Guardium Appliance vulnerability analysis and mitigation

IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. This vulnerability (CVE-2021-20419) was discovered and disclosed on May 21, 2021. The vulnerability affects IBM Security Guardium version 11.2 and other versions (10.5, 10.6, 11.0, 11.1, 11.3) (IBM Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) by NIST NVD, while IBM Corporation rated it with a CVSS v3.0 base score of 6.8 MEDIUM (Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) (NVD).

The vulnerability could allow an attacker to decrypt highly sensitive information due to the implementation of cryptographic algorithms that are weaker than expected. The impact is primarily focused on confidentiality, with no direct impact on integrity or availability of the system (NVD).

The vulnerability is exploitable over the network (AV:N) with no authentication required (PR:N) and no user interaction needed (UI:N). However, the attack complexity is considered high (AC:H) according to IBM's assessment (IBM Advisory).

IBM has released security fixes for all affected versions. For version 11.2, the fix is available through IBM Fix Central at SqlGuard_11.0p250_Bundle_Jul-14-2021. Users are advised to apply the appropriate fixes for their installed version (IBM Advisory).