OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by Cognos Insight. Cognos Insight has addressed the applicable CVEs.
CVEID: CVE-2015-0204 DESCRIPTION: A vulnerability in the OpenSSL ssl3_get_key_exchange function could allow a remote attacker to downgrade the security of certain TLS connections. An OpenSSL client accepts the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.
This vulnerability is also known as the FREAK attack.
CVSS Base Score: 4.3
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/99707> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cognos Insight 10.2
Cognos Insight 10.2.1
Cognos Insight 10.2.2
IBM Cognos Insight Standalone 10.2.1 FP2 IF3
IBM Cognos Insight Standalone 10.2.0 FP1 IF3
IBM Cognos Insight Standard Edition 10.2.2 Fix Pack 3
None