medium6.5
CVE-2019-6157
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's priva…
Impact
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Flex System X240 M4 Firmware | before 5.30 |
| Lenovo | Flex System X240 M5 Firmware | before 5.30 |
| Lenovo | Flex System X280 X6 Firmware | before 5.30 |
| Lenovo | Flex System X440 M4 Firmware | before 5.30 |
| Lenovo | Flex System X480 X6 Firmware | before 5.30 |
| Lenovo | Flex System X880 Firmware | before 5.30 |
| Lenovo | Nextscale Nx360 M5 Firmware | before 5.30 |
| Lenovo | System X3250 M6 Firmware | before 5.30 |
| Lenovo | System X3500 M5 Firmware | before 5.30 |
| Lenovo | System X3550 M5 Firmware | before 5.30 |
| Lenovo | System X3650 M5 Firmware | before 5.30 |
| Lenovo | System X3750 M4 Firmware | before 5.30 |