Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearQuest (CVE-2016-0702)

Summary

An OpenSSL vulnerability was disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Rational ClearQuest. IBM Rational ClearQuest has addressed the applicable CVE.

Vulnerability Details

CVEID: CVE-2016-0702
DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a side-channel attack against a system based on the Intel Sandy-Bridge microarchitecture. An attacker could exploit this vulnerability to recover RSA keys.
CVSS Base Score: 2.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111144 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

• IBM Rational ClearQuest, versions 7.1.0.x, 7.1.1.x, 7.1.2.x, 8.0.0.x, 8.0.1.x, and 9.0 in the following component:

• ClearQuest hooks and cqperl/ratlperl scripts that use SSL.

• Database drivers configured to use SSL connections to the database.

ClearQuest version

|

Status

—|—

9.0 through 9.0.0.1

|

Affected

8.0.1 through 8.0.1.11

|

Affected

8.0 through 8.0.0.18

|

Affected

7.1.0.x
7.1.1.x
7.1.2.x
(all versions and fix packs)

|

Affected

Remediation/Fixes

Affected Versions

|

** Fixes**

—|—

9.0 through 9.0.0.1

| Install Rational ClearQuest Fix Pack 2 (9.0.0.2) for 9.0

8.0.1 through 8.0.1.10

| Install Rational ClearQuest Fix Pack 12 (8.0.1.12) for 8.0.1

8.0 through 8.0.0.17

| Install Rational ClearQuest Fix Pack 19 (8.0.0.19) for 8.0

7.1.2.x (all fix packs)
7.1.1.x (all fix packs)
7.1.0.x (all fix packs)

| Customers on extended support contracts should contact customer support.

For 7.0.x, 7.1.x and earlier releases, IBM recommends upgrading to a fixed, supported version/release/platform of the product.