Security Bulletin: IBM WebSphere Hypervisor Edition on zLinux for SmartCloud Orchestrator is affected by vulnerability in OpenSSL (CVE-2014-0160)

Summary

A Security vulnerability has been discovered in OpenSSL that affects the IBM WebSphere Hypervisor Edition v8.5.5.1 on zLinux for SmartCloud Orchestrator tech preview. Other versions of IBM WebSphere Application Server Hypervisor editions are not affected.

Vulnerability Details

CVE-ID:CVE-2014-0160

**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability to expose 64k of private memory and retrieve secret keys. This vulnerability can be remotely exploited, authentication is not required and the exploit is not complex. An exploit can only partially affect the confidentially, but not integrity or availability.

CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92322
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Warning: We strongly encourage you to take action as soon as possible as potential implications to your environment may be more serious than indicated by the CVSS score.

Affected Products and Versions

IBM WebSphere Hypervisor Edition v8.5.5.1 on zLinux for SmartCloud Orchestrator

Other versions of IBM WebSphere Application Server Hypervisor Editions are not affected by this vulnerability.

Remediation/Fixes

Update the zLinux image from Red Hat

Workarounds and Mitigations

none