Security Bulletin: OpenSSL vulnerability affects App Connect professional v7.5.4.

Summary

OpenSSL vulnerability is addressed in ACP v7.5.5.0, customer can migrate to this version without incurring any additional cost.

Vulnerability Details

CVEID:CVE-2022-2097
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by improper encryption of data by the AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230425 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Customers should migrate to ACPv755 and upgrade to the latest iFix available in Fixcentral. Base release can be downloaded from here and latest iFix release here.

Workarounds and Mitigations

None