Security Bulletin: OpenSSL vulnerability affects App Connect professional v7.5.4.

Summary

OpenSSL vulnerability is addressed in ACP v7.5.5.0, customer can migrate to this version without incurring any additional cost.

Vulnerability Details

CVEID:CVE-2022-1292
**DESCRIPTION:**OpenSSL could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the c_rehash script. By sending a specially-crafted request using shell metacharacters, an attacker could exploit this vulnerability to execute arbitrary commands with the privileges of the script on the system.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225619 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

Customers should migrate to ACPv755 and upgrade to the latest iFix available in Fixcentral. Base release can be downloaded from here and latest iFix release here.

Workarounds and Mitigations

None