CA IM (IGA) CVE-2020-1938 (Ghostcat) vulnerability

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

CA Broadcom Identity Manager (also known as Symantec IGA) employs Apache Tomcat in the Virtual Appliance and makes use of the Apache JServ Protocol (AJP).  This is subject to the CVE-2020-1938 (Ghostcat) vulnerability. This vulnerability is rated at 9.8 Critical Severity.  Please give this high attention.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1938

Environment

Release : 14.x

Component : CA IDENTITY SUITE (VIRTUAL APPLIANCE)

Resolution

Patches and deployment instructions for the following versions of these Virtual Appliance components are available via the following locations:

14.3:

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-suite/14-3/release-notes/Virtual-Appliance-Release-Notes/Hotfixes.html

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/identity-suite/14-3/virtual-appliance/configuring-virtual-appliance.html#concept.dita_e8bc3a132b722521f1368d7a3210969a821df413_ToggleAJPListener

Additional Information

In addition, the CA Identity Manager report server solution, which is based on TIBCO JasperSoft also utilizes Apache Tomact. For more information on how to mitigate this CVE, please follow the instructions on this link:

https://community.jaspersoft.com/wiki/fixing-tomcat-cve-2020-1938-tibco-jasperreporrts-server

This is also discussed in the KB article Is CABI Jaspersoft vulnerable by CVE-2020-1938 "GhostCat" vulnerability? (https://knowledge.broadcom.com/external/article?articleId=185905)