Axis Security Vulnerabilities (CVE-2023-40743) - Identity Manager

Products

• CA Identity Manager
• CA Identity Portal
• CA Identity Suite
• CA Identity Governance

Issue/Introduction

A security vulnerability (CVE-2023-40743) has been identified in the ant and axis JAR files currently included in the CA Identity Manager 14.5 release. This article outlines the product roadmap regarding this issue.

Environment

Identity Manager 14.5

Cause

The ant and axis libraries used in the current release are subject to CVE-2023-40743. Addressing these libraries in the current version is not feasible due to complex, high-level dependencies on other critical components.

Resolution

Because of these architectural dependencies, a hotfix cannot be implemented for this issue. This vulnerability is prioritized for resolution in the next major product release (IGA v15), which will migrate to Axis2 to fully remediate the reported CVEs.

Users are encouraged to update to IGA v15

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.