RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contai

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• dell bsafe4.1.0 and later · before 4.1.6.1
• dell bsafe crypto-c4.0.0 and later · before 4.0.5.3
• oracle application testing suite13.3.0.1
• oracle communications analytics12.1.1
• oracle communications ip service activator7.3.0
• oracle communications ip service activator7.4.0
• oracle core rdbms11.2.0.4
• oracle core rdbms12.1.0.2
• oracle core rdbms12.2.0.1
• oracle core rdbms18c
• oracle core rdbms19c
• oracle enterprise manager ops center12.3.3
• oracle enterprise manager ops center12.4.0
• oracle goldengate application adapters12.3.2.1.0
• oracle jd edwards enterpriseone tools9.2
• oracle real user experience insight13.1.2.1
• oracle real user experience insight13.2.3.1
• oracle real user experience insight13.3.1.0
• oracle retail predictive application server15.0.3
• oracle retail predictive application server16.0.3.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (dell). Independent of NVD's CPE analysis and usually ahead of it.

• RSA BSAFE Crypto-C Micro Edition

  • unspecified and later · before 4.0.5.3affected

• RSA BSAFE Micro Edition Suite

  • unspecified and later · before 4.1.6.1affected

Other highest-scoring records for the same primary product.

• CVE-2018-11058RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, vers
  40Plan
• CVE-2015-0537Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3
  40Plan
• CVE-2018-15769RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key manag
  31Monitor
• CVE-2018-11054RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability.
  31Monitor
• CVE-2015-0536EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authent
  31Monitor
• CVE-2016-0923The client in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a sig
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.