Security Bulletin:Build Forge is affected by the following OpenSSL vulnerabilities (CVE-2014-0224)

Summary

Security vulnerabilities which impact IBM Rational Build Forge have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVE-ID:CVE-2014-0224

**Description:**OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and servers. A remote attacker could exploit this vulnerability using a specially-crafted handshake to conduct man-in-the-middle attacks to decrypt and modify traffic.

CVSS Base Score: 5.8 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/93586&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

Affected Products and Versions

Rational Build Forge: 8.0,8.0.0.1,8.0.0.2

Remediation/Fixes

Apply the correct iFix for your version of Build Forge:

Workarounds and Mitigations

Upgrade the openSSL in Build Forge install directory on the Build Forge console machine.