CVE-2019-4427 - IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate

Back Back to CVE browser

HIGH

IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate

Published Feb 12, 2020

7.5

HIGH

CVSS 3.1

EPSS 0.49%

Description

IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a installer with malicious software inside. IBM X-Force ID: 162773.

Affected products

Vendor IBM Product Cloud CLI Default
n/a
- Version
  0.16.1
  Status
  affected
  Constraints
  -
- Version
  0.6.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Cloud CLI

n/a

Version	Status	Constraints
0.16.1	affected	-
0.6.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-327

Broken Crypto Algorithm

References (2)

https://exchange.xforce.ibmcloud.com/vulnerabilities/162773
vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/1356087
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/162773		vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/1356087		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Feb 12, 2020

Updated Sep 16, 2024

Reserved Jan 3, 2019

Link CVE-2019-4427

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-4427

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-4427