Lucene search

K
ibmIBM70A3DA093ABDE18F72C315FEE3BB4BF5BC15B78D8580EF9CAE5E47A72E111EE0
HistoryDec 07, 2021 - 7:14 p.m.

Security Bulletin: This Power System update is being released to address CVE-2018-0732

2021-12-0719:14:45
www.ibm.com
22

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.054 Low

EPSS

Percentile

92.4%

Summary

POWER9: In response to a denial of service vulnerability in OpenSSL, a new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-0732.
A malicious server can send a large prime value to a client during DH(E) TLS handshake causing the client to hang. This can disrupt the HMC communications for system management and partition operations.

Vulnerability Details

CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during key agreement in a TLS handshake. By spending an unreasonably long period of time generating a key for this prime, a remote attacker could exploit this vulnerability to cause the client to hang.
CVSS Base Score: 3.7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/144658&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Firmware release FW910 and FW920 are affected.

Remediation/Fixes

Customers with the products below, install FW910.30

  1. IBM Power Systems S922 (9009-22A)
  2. IBM Power SystemsH922 (9223-22H)
  3. IBM Power Systems S914 (9009-41A)
  4. IBM Power Systems S924 (9009-42A)
  5. IBM Power Systems H924 (9223-42H)
  6. IBM Power Systems L922 (9008-22L)

Customers with the products below, install FW920.30

  1. IBM Power Systems E950(9040-MR9)

  2. IBM Power Systems E980(9080-M9S)

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.054 Low

EPSS

Percentile

92.4%