RSA coughs to critical-rated bug in its authentication SDK

RSA developers and admins have been given two critical-level authentication bugs to patch. For the sysadmin, the issue struck RSA's software providing Web-based authentication for Apache. CVE-2017-14377 is an authentication bypass that existed because of an “input validation flaw in RSA Authentication Agent for Web for Apache …

[Anonymous Coward]

Who could possibly gain from this ?

[John Smith 19]

" Who could possibly gain from this ?"

Probably the same people who benefited from having a lower security encryption algorithm set up as the default?

RSA are starting to look very TLA friendly.

And that's not a good thing given their core business.

[A Non e-mouse]

How much did the NSA pay RSA to put those bugs features in, I wonder...

[Paul Crawford]

I believe the going rate is $10M:

https://www.theregister.co.uk/2013/12/21/nsa_paid_rsa_10_million/

[Harry from Seattle]

Or maybe Mossad. RSA is an untrustworthy organization.