Security Bulletin: IBM InfoSphere Master Data Management is vulnerable to OpenSSLvulnerability (CVE-2017-3735)

Summary

IBM InfoSphere Master Data Management is vulnerable to OpenSSL vulnerability that could allow an attacker to obtain sensitive information by triggering an out-of-bounds read and resulting in the incorrect text display of the certificate.

Vulnerability Details

CVEID: CVE-2017-3735**
DESCRIPTION:** OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error while parsing an IPAdressFamily extension in an X.509 certificate. An attacker could exploit this vulnerability to trigger an out-of-bounds read, resulting in an incorrect text display of the certificate.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/131047 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Affected Products and Versions

This vulnerability is known to affect the following offerings:

Affected IBM Initiate Master Data Service

|

Affected Versions

—|—
IBM Initiate Master Data Service| 10.1
IBM InfoSphere Master Data Management| 11.0
IBM InfoSphere Master Data Management| 11.3
IBM InfoSphere Master Data Management| 11.4
IBM InfoSphere Master Data Management| 11.5
IBM InfoSphere Master Data Management| 11.6

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please see below for information on the fixes available.

10.1

| None| 10.1.031518_IM_Initiate_MasterDataService_ALL_Refresh Pack
IBM InfoSphere Master Data Management Standard/Advanced Edition|

11.0

| None| 11.0.0.7-MDM-SAE-FP07IF0090_ _
IBM InfoSphere Master Data Management Standard/Advanced Edition|

11.3

| None| 11.3.0.7-MDM-SE-AE-FP07IF000
IBM InfoSphere Master Data Management Standard/Advanced Edition|

11.4

| None| 11.4.0.8-MDM-SAE-FP08IF000
IBM InfoSphere Master Data Management Standard/Advanced Edition|

11.5

| None| 11.5.0.6-MDM-SAE-FP06IF000
IBM InfoSphere Master Data Management Standard/Advanced Edition|

11.6

| None| _11.6.0.4-MDM-SE-AE _

Workarounds and Mitigations

None