CVE-2017-1665

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 133559.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
IBM	Security Key Lifecycle Manager	2.5; 2.6; 2.7

References

http://www.ibm.com/support/docview.wss?uid=swg22012023Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/133559VDB Entry, Vendor Advisory
https://www.debian.org/security/2018/dsa-4262Third Party Advisory
http://www.ibm.com/support/docview.wss?uid=swg22012023Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/133559VDB Entry, Vendor Advisory
https://www.debian.org/security/2018/dsa-4262Third Party Advisory

Timeline

Published: Jan 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-166506.6The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service CVE-2017-166517.8Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's file CVE-2017-166526.1An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthentica CVE-2017-166535.9An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF prote CVE-2017-166547.5An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bund CVE-2017-166597.8The Gentoo mail-filter/assp package 1.9.8.13030 and earlier allows local users to gain privileges by leveraging access to the assp user acco CVE-2017-16668.1IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A CVE-2017-166607.2Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root,CVE-2017-166614.9Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then m CVE-2017-166635.5In sam2p 0.49.4, there are integer overflows (with resultant heap-based buffer overflows) in input-bmp.ci in the function ReadImage, because CVE-2017-166648.8Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3 CVE-2017-166656.1RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting (XSS) attack via the service parameter to the