Read the docs
TI-2018-07841 Aliases CVE-2018-11055GHSA-7mh8-r5jc-g27h

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1…

Priority LOW 25CWE-404Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-404.

Summary

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection.

Why it matters now

EPSS 0.00426 37th percentileScored 2026-11-07
Fix Fixed BSAFE Micro Edition Suite (RSA): 4.0.11, 4.1.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RSABSAFE Micro Edition Suitebefore 4.0.11; before 4.1.6.14.0.11, 4.1.6.1Patch availableCNA
  • BSAFE Micro Edition Suite VendorRSA Affected before 4.0.11; before 4.1.6.1 Fixed in 4.0.11, 4.1.6.1 Patch available CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:dell:bsafe:*:*:*:*:micro_edition_suite:*:*:*4.0.0 to before 4.0.11; 4.1.0 to before 4.1.6.1VulnerableDell
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*13.3.0.1VulnerableOracle
cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*12.1.1VulnerableOracle
cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableOracle
cpe:2.3:a:oracle:core_rdbms:11.2.0.4:*:*:*:*:*:*:*11.2.0.4VulnerableOracle
cpe:2.3:a:oracle:core_rdbms:12.1.0.2:*:*:*:*:*:*:*12.1.0.2VulnerableOracle
cpe:2.3:a:oracle:core_rdbms:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:core_rdbms:18c:*:*:*:*:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:core_rdbms:19c:*:*:*:*:*:*:*19cVulnerableOracle
  • cpe:2.3:a:dell:bsafe:*:*:*:*:micro_edition_suite:*:*:* Versions 4.0.0 to before 4.0.11; 4.1.0 to before 4.1.6.1 Vulnerable ·Dell
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_ip_service_activator:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:core_rdbms:11.2.0.4:*:*:*:*:*:*:* Versions 11.2.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:core_rdbms:12.1.0.2:*:*:*:*:*:*:* Versions 12.1.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:core_rdbms:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:core_rdbms:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:core_rdbms:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*12.3.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*12.4.0VulnerableOracle
cpe:2.3:a:oracle:goldengate_application_adapters:12.3.2.1.0:*:*:*:*:*:*:*12.3.2.1.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*9.2VulnerableOracle
cpe:2.3:a:oracle:real_user_experience_insight:13.1.2.1:*:*:*:*:*:*:*13.1.2.1VulnerableOracle
cpe:2.3:a:oracle:real_user_experience_insight:13.2.3.1:*:*:*:*:*:*:*13.2.3.1VulnerableOracle
cpe:2.3:a:oracle:real_user_experience_insight:13.3.1.0:*:*:*:*:*:*:*13.3.1.0VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:security_service:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:security_service:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:security_service:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*before 18.1.4.1.0VulnerableOracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:goldengate_application_adapters:12.3.2.1.0:*:*:*:*:*:*:* Versions 12.3.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real_user_experience_insight:13.1.2.1:*:*:*:*:*:*:* Versions 13.1.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real_user_experience_insight:13.2.3.1:*:*:*:*:*:*:* Versions 13.2.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real_user_experience_insight:13.3.1.0:*:*:*:*:*:*:* Versions 13.3.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:security_service:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:security_service:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:security_service:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 18.1.4.1.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA BSAFE Micro Edition Suite (RSA) Fixed in 4.0.11, 4.1.6.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    RSA BSAFE Micro Edition Suite 4.0.11, 4.1.6.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2018-07843 Broken or risky cryptographic algorithm in RSA BSAFE Micro Edition SuitePriority LOW 30
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11055
  2. 2026-10-03 Alias added: GHSA-7mh8-r5jc-g27h

References

Patch 5

Advisory 1

  • TI-2005-04464 Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka… CVSS 2.0MEDIUM 6.4
  • TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
  • TI-2024-16531 XML external entity injection in RSA Authentication Manager CVSS 3.1MEDIUM 4.3
  • TI-2024-32115 In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be… CVSS 3.1CRITICAL 9.8
  • TI-2018-07844 Out-of-bounds read in RSA BSAFE Micro Edition Suite CVSS 3.1CRITICAL 9.8
  • TI-2017-10489 Improper authentication in RSA Authentication Agent for Web for Apache Web Server RSA… CVSS 3.0CRITICAL 9.8
See all 125 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences