search cancel

Is the CA Identity Suite impacted by vulnerability CVE-2018-11776

book

Article ID: 112297

calendar_today

Updated On:

Products

CA Identity Manager CA Identity Governance CA Identity Portal CA Risk Analytics CA Secure Cloud SaaS - Arcot A-OK (WebFort) CLOUDMINDER ADVANCED AUTHENTICATION CA Secure Cloud SaaS - Advanced Authentication CA Secure Cloud SaaS - Identity Management CA Secure Cloud SaaS - Single Sign On

Issue/Introduction



Is the CA Identity Suite impacted by newly announced vulnerability CVE-2018-11776:

NIST:

https://nvd.nist.gov/vuln/detail/CVE-2018-11776

The MITRE CVE dictionary describes this issue as:

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when using results with no namespace and in same time, its upper action(s) have no or wildcard namespace. Same possibility when using url tag which doesn't have value and action set and in same time, its upper action(s) have no or wildcard namespace.
Find out more about CVE-2018-11776 from the MITRE CVE dictionary dictionary and NIST NVD.
 

Environment

Release: CAIDMB99000-14.0-Identity Manager-B to B
Component:

Resolution

The CA team has confirmed that all versions of CA Identity Suite are not vulnerable to this exploit.

CA Identity Suite Version 14.2 uses a vulnerable version of Apache Struts 2.5.14.1 in CA Identity Manager’s Management Console. Due to the implementation of Namespaces appropriately with default values, and no URL without Tags or with empty values, no malicious Remote Code could be inserted to exploit this vulnerability.


CA Identity Suite Versions 14.1 and earlier use an Apache Struts version 1 which is not susceptible to this vulnerability.


With the next release, CA Identity Suite 14.3, we will be updating Apache Struts to a version where this vulnerability is addressed.