4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
An OpenSSL vulnerability has been identified in the current levels of IBM Spectrum Scale V4.1.1 and IBM GPFS V4.1.
IBM PureApplication System provides a GPFS pattern and addressed the applicable CVE.
CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error when processing an ECParameters structure over a specially crafted binary polynomial field. A remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103778 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
IBM PureApplication System V2.1 (GPFS Pattern type 1.2.1.0) using IBM GPFS V4.1.0.5
IBM PureApplication System V2.1.0.1 (GPFS Pattern type 1.2.2.0) using IBM GPFS V4.1.0.7
IBM PureApplication System V2.1.1 (GPFS Pattern type 1.2.3.0) using IBM GPFS V4.1.0.7
GPFS server or client instances deployed with the affected GPFS Pattern versions are vulnerable. To determine whether deployed GPFS sever or client instances are affected by these GPFS security vulnerabilities, run the Get Cluster Status operation ( for a GPFS server instance ) or the GPFS Client Status operation ( for a GPFS client instance ) to verify the version reported for the GPFS nodes. The instance is affected if the GPFS version is V4.1.0.5 or V4.1.0.7.
The solution is to apply one of the following interim fixes or upgrade the PureApplication System to V2.1.2 or higher, and upgrade this instance using the pattern upgrade procedure.
The GPFS Pattern type 1.2.4.0 that is delivered with IBM PureApplication System V2.1.2.0 installs GPFS 4.1.1.2. Any instances deployed with this GPFS pattern type version or upgraded to this version will not be affected by this CVE.
Whenever possible, the PureApplication System upgrade option is recommended instead of the interim fixes.
None
CPE | Name | Operator | Version |
---|---|---|---|
pureapplication system | eq | 2.1.1.0 | |
pureapplication system | eq | 2.1.0.2 | |
pureapplication system | eq | 2.1.0.1 | |
pureapplication system | eq | 2.1.0.0 |