Security Bulletin: Vulnerability in OpenSSL affects IBM Watson Explorer (CVE-2022-0778)

Summary

OpenSSL is used by IBM Watson Explorer OneWEX and Foundational Components. IBM Watson Explorer has addressed the applicable CVE (CVE-2022-0778).

Vulnerability Details

CVEID:CVE-2022-0778
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by a flaw in the BN_mod_sqrt() function when parsing certificates. By using a specially-crafted certificate with invalid explicit curve parameters, a remote attacker could exploit this vulnerability to cause an infinite loop, and results in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221911 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

12.0.0.0, 12.0.0.1

12.0.1,

12.0.2.0 - 12.0.2.2,

12.0.3.0 - 12.0.3.9

IBM Watson Explorer DAE Foundational Components |

12.0.0,

12.0.1,

12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.9

IBM Watson Explorer Foundational Components | 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 - 11.0.2.13

Remediation/Fixes

Follow these steps to upgrade to the required version of OpenSSL.

12.0.0.0, 12.0.0.1

12.0.1,

12.0.2.0 - 12.0.2.2,

12.0.3.0 - 12.0.3.9

|

Upgrade to Version 12.0.3.10.

See Watson Explorer Version 12.0.3.10 OneWEX Components for download information and instructions.

IBM Watson Explorer DAE
Foundational Components |

12.0.0,

12.0.1,

12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.9

|

Upgrade to Version 12.0.3.10.

See Watson Explorer Version 12.0.3.10 Foundational Components for download information and instructions.

IBM Watson Explorer
Foundational Components | 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 - 11.0.2.13 |

Upgrade to Version 11.0.2.14.

See Watson Explorer Version 11.0.2.14 Foundational Components for download information and instructions.

Workarounds and Mitigations

None