Potential information disclosure relating to BC-SEC, SAP security note 1902611

SAP security note 1902611, "Potential information disclosure relating to BC-SEC", is a note. Below are the SAP recommended solution and the affected software components.

Description

Solution

• Documentation Update. The documentation of the secure storage in the database has been updated to revoke the obsolete text and replace it with new information recommending the use of your own encryption key.
• Key Management Support. The administration program for the secure storage (transaction SECSTORE) now indicates the encryption key method currently used and offers a link to a key management tool that guides you through introducing or updating your own key.
• Recommendation for Key File Location and Name. It is recommended to set the profile parameter rsec/securestorage/keyfile to $(DIR_GLOBAL)$(DIR_SEP)security$(DIR_SEP)data$(DIR_SEP)SecStoreDBKey.pse. The file extension .pse is a deliberate choice for this text file.

CVSS

Score 2.1 Vector: AV:N/AC:H/AU:S/C:P/I:N/A:N

Affected components

• SAP_BASIS (versions 700, 710, 711, 720, 730, 731, 740)