WebSphere Liberty could provide weaker than expected security due to crypto.js (CVE-2020-36732 CVSS 5.3) #32824
Description
Describe the bug
WebSphere Liberty could provide weaker than expected security due to crypto.js (CVE-2020-36732 CVSS 5.3)
Steps to Reproduce
Security Bulletin: https://www.ibm.com/support/pages/node/7244573
Expected behavior
The bug is fixed in Open Liberty 25.0.0.10 and above.
Diagnostic information:
- OpenLiberty Version: 17.0.0.3 - 25.0.0.9
- Affected feature(s): openidConnectServer-1.0
- Java Version: all