Security Bulletin: One or more security vulnerabilities has been identified in OpenSSL in IBM® AIX® shipped with IBM PureData System for Operational Analytics (CVE-2019-1559,CVE-2019-1547,CVE-2019-1563)

Summary

IBM® AIX® is shipped as a component of IBM PureData System for Operational Analytics. Information about security vulnerabilities in OpenSSL affecting IBM AIX have been published in a security bulletin (CVE-2019-1559,CVE-2019-1547,CVE-2019-1563).

Vulnerability Details

CVEID:CVE-2019-1547
**DESCRIPTION:**OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC group missing the cofactor using explicit parameters instead of using a named curve. An attacker could exploit this vulnerability to obtain full key recovery during an ECDSA signature operation.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/167020 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2019-1563
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7_dataDecode and CMS_decrypt_set1_pkey. By sending an overly large number of messages to be decrypted, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/167022 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2019-1559
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding. An attacker could exploit this vulnerability using a 0-byte record padding-oracle attack to decrypt traffic.
CVSS Base score: 5.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/157514 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

CVEID:CVE-2019-1551
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By performing a man-in-the-middle attack, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 6.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172752 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

OpenSSL installp packages are available. Please refer to the table below to determine the minimum levels needed.

| Minimum Appliance Version| AIX Fileset Version
—|—|—
OpenSSL| PureData System for Operational Analytics V1.1 FP5| 1.0.2.2104 [ Included in V1.1 FP5 ]

For instructions on how to apply an IBM PureData System for Operational Analytics fix pack update, refer to PureData System for Operational Analytics fix pack readme documents.

For instructions on how to apply the update, refer to Updating the system installed IBM® openSSL and openSSH packages in an IBM PureData System for Operational Analytics environment.

Workarounds and Mitigations

None