Security Bulletin: Vulnerability in OpenSSL affects IBM Cloud Pak System (CVE-2020-1971)

Summary

Vulnerability in OpenSSL affects IBM Cloud Pak System. IBM Cloud Pak System has resolved this issue.

Vulnerability Details

CVEID:CVE-2020-1971
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERAL_NAME_cmp function contain an EDIPARTYNAME, an attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/192748 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

For unsupported release/version/platform recommendation is to upgrade to supported fixed release of the product.

For Cloud Pak System V2.3.0.1, V.2.3.1.1, v.2.3.2.0, v2.3.3.0, v.2.3.3.1, v.2.3.3.2,

upgrade to IBM Cloud Pak System v2.3.3.3 , apply IBM Cloud Pak System v2.3.3.3 Interim Fix 1 at Fix Central

For Cloud Pak System v2.3.3.3 apply Cloud Pak System v2.3.3.3 Interim Fix 1 at Fix Central

Information on upgrading : http://www.ibm.com/support/docview.wss?uid=ibm10887959.

Workarounds and Mitigations

None