Security Bulletin: TS2900 is affected by the following OpenSSL vulnerabilities: CVE-2014-0224

Summary

Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project.

Vulnerability Details

CVE-2014-0224

**DESCRIPTION:**OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and servers. A remote attacker could exploit this vulnerability using a specially-crafted handshake to conduct man-in-the-middle attacks to decrypt and modify traffic.

CVSS Base Score: 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93586 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

Affected Products and Versions

All TS2900 tape libraries with firmware version lower than 0033.

Remediation/Fixes

Apply firmware version 0033 or later, available from IBM Fix Central
<http://www-933.ibm.com/support/fixcentral/&gt;

Workarounds and Mitigations

None known.