Security Bulletin: Multiple vulnerabilities in TLS in Cloud Pak for Automation

Summary

There are multiple vulnerabilities in the TLS protocol implementation in Business Automation Insights (BAI) in Cloud Pak for Automation. These have been addressed.

Vulnerability Details

CVEID:CVE-2013-0169
**DESCRIPTION:**The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the “Lucky Thirteen” issue.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/81902 for the current score.
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID:CVE-2011-1473
**DESCRIPTION:**DISPUTED OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094.NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/71068 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

Remediation/Fixes

The vulnerabilities referenced above, related to the TLS protocol, have impacted the Business Automation Insights (BAI) component in IBM Cloud Pak for Automation. These have been fixed in the version 19.0.3, released in 2019 Q4.

Workarounds and Mitigations

Customers using previous versions of Cloud Pak for Automation should upgrade to 19.0.3.