CVE-2018-7119
Description
A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or T9750H05^AIH, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND; all versions on H-series. STDSEC-STANDARD SECURITY PROD All prior versions before T6533L01^ADU or T6533H05^ADW, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND and all versions on H-series . Note that some commands in NonStop Safeguard and NonStop Standard Security software require username and password to be passed as command line parameters, which may lead to a local disclosure of the credentials.
How to fix
- hp nonstop_safeguard_j_seriest9750h05\^aih or later
- hp nonstop_safeguard_l_seriest9750l01\^aic or later
- hp nonstop_standard_security_l_seriest6533l01\^adu or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hp nonstop_safeguard_h_series | No range specified | — |
| hp nonstop_safeguard_j_series | v < t9750h05\^aih | t9750h05\^aih |
| hp nonstop_safeguard_l_series | v < t9750l01\^aic | t9750l01\^aic |
| hp nonstop_standard_security_h_series | No range specified | — |
| hp nonstop_standard_security_j_series | v ≤ t6533h05\^adw | — |
| hp nonstop_standard_security_l_series | v < t6533l01\^adu | t6533l01\^adu |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.