Vulnerability Status for CVE-2023-38545 and CVE-2023-38546 in Curl - Identity Suite

Products

• CA Identity Governance
• CA Identity Manager
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article clarifies the security vulnerability status of the Identity Governance and Administration (IGA) product suite regarding CVE-2023-38545 and CVE-2023-38546, which pertain to the curl library.

Environment

Identity Manager 14.5

Identity Governance 14.5

Identity Portal 14.5

vAPP and non-vAPP

Resolution

The IGA suite of products is not vulnerable to CVE-2023-38545 or CVE-2023-38546.

• CVE-2023-38545: This CVE is not applicable because the version of curl utilized by IGA components is not susceptible to this vulnerability.
• CVE-2023-38546: This CVE is not applicable because IGA components do not utilize the specific function associated with this vulnerability.

Recommendation If vulnerability scans flag your system for these CVEs, provide this information to your internal security team to confirm that the IGA products are not susceptible to these specific flaws.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.