October 27, 2021

CVE Identifier

CVE-2021-40438

Severity

Critical

Severity Rating

9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

SecurID recommends all customers consider both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with a particular security vulnerability.

Affected Products

Identity router software version 12.12 and earlier with operating system SUSE Linux Enterprise Server (SLES) 12 SP5.

Summary

Identity router version 12.12 and earlier with SLES 12 SP5 contains a vulnerability that  allows a Server-Side Request Forgery (SSRF) on the Apache mod_proxy module.

Details

The identity router has been updated to address the following vulnerability:

Vulnerability in the Apache mod_proxy module

Identity router software version 12.12 and earlier with operating system SLES 12 SP5 contains a vulnerability that allows a Server-Side Request Forgery (SSRF) on Apache on the mod_proxy module. A remote attacker could potentially exploit this vulnerability by sending arbitrary requests from the impacted server and potentially access and retrieve responses from local or internal network services. Exploitation can allow an attacker to pivot or exploit internal systems accessible from the impacted server.

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm. To search for a particular CVE, use the database’s search utility at http://web.nvd.nist.gov/view/vuln/search.

Recommendation

The following identity router software release resolves this vulnerability:

•  Identity router software version 12.12.0.0.17

SecurID recommends all customers upgrade at the earliest opportunity. For more information, see Update Identity Router Software.

Note: As this is a software patch release, Update Available status will not display for identity router 12.12 and earlier in the Cloud Administration Console.

EOPS Policy

RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.

Legal Information

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact RSA Customer Support. RSA Security LLC and its affiliates distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information.

RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement.

In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.