Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM PureApplication System and IBM PureApplication System supporting products

Summary

Multiple Vulnerabilities in OpenSSL as reported by the OpenSSL project, and IBM PureApplication System supporting products affects IBM PureApplication System. IBM PureApplication System addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2017-3731

DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read when using a specific cipher. By sending specially crafted truncated packets, a remote attacker could exploit this vulnerability using CHACHA20/POLY1305 to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/121312 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

IBM PureApplication System V2.2
IBM PureApplication System V2.1

Remediation/Fixes

The PureSystems Manager on IBM PureApplication System is affected.

The solution is to upgrade the IBM PureApplication System to the following fix level:

IBM PureApplication System V2.2:
Upgrade to IBM PureApplication System V2.2.6

IBM PureApplication System V2.1:
IBM recommends upgrading to a fixed version of the product.

IBM DataPower Gateways Security Bulletin

|

IBM Spectrum Scale Security Bulletin

CVE-2017-3732 | IBM HMC Security Bulletin
|

IBM Spectrum Scale Security Bulletin

CVE-2016-7055 |

IBM DataPower Gateways Security Bulletin

Notice IBM PureApplication System V2.2.6.0 updated to openSSL1.0.2r .

Upgrade the IBM PureApplication System to the following fix release:

• IBM PureApplication System V2.2.6.0

Information on upgrading can be found here: <http://www-01.ibm.com/support/docview.wss?uid=swg27039159&gt;

Workarounds and Mitigations

None