Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Workload Scheduler

Summary

OpenSSL vulnerabilities CVE-2019-1559 and CVE-2018-5407 were disclosed by the OpenSSL Project. OpenSSL is used by IBM Workload Manager. IBM Workload Manager has addressed the applicable CVEs

Vulnerability Details

CVE-ID: CVE-2018-5407
Description: Multiple SMT/Hyper-Threading architectures and processors could allow a local attacker to obtain sensitive information, caused by execution engine sharing on Simultaneous Multithreading (SMT) architecture. By using the PortSmash new side-channel attack, an attacker could run a malicious process next to legitimate processes using the architecture’s parallel thread running capabilities to leak encrypted data from the CPU’s internal processes.
Note: This vulnerability is known as PortSmash.
CVSS Base Score: 5.1
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/152484 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVE-ID: CVE-2019-1559
Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding. An attacker could exploit this vulnerability using a 0-byte record padding-oracle attack to decrypt traffic.
CVSS Base Score: 5.8
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/157514 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

Affected Products and Versions

IBM Workload Scheduler uses OpenSSL only for secure communication between internal processes.
For IBM Workload Scheduler Distributed, Workload Scheduler nodes are impacted by OpenSSL security exposures only if the IWS workstation has been defined with “securitylevel” set to on or enabled or force.
These security exposures do not apply to WebSphere Application Server but only to programs installed under <TWS home>/bin.

The following IBM Workload Scheduler releases are potentially affected:
Tivoli Workload Scheduler Distributed 9.2.0 FP03 and earlier
IBM Workload Scheduler Distributed 9.3.0 FP03 and earlier
IBM Workload Scheduler Distributed 9.4.0 FP05 and earlier

IBM Workload Scheduler Distributed 9.5.0 GA

Remediation/Fixes

APAR IJ14588 has been opened to address the openssl vulnerabilities for IBM Workload Scheduler.
The following limited availability fixes for IJ14588 are available for download on FixCentral
9.2.0-TIV-TWS-FP0003-IJ14588
to be applied on top of Tivoli Workload Scheduler Distributed 9.2.0 FP03
9.3.0-TIV-TWS-FP0003-IJ14588
to be applied on top of Tivoli Workload Scheduler Distributed 9.3.0 FP03

APAR IJ14588 has been included in 9.4.0-TIV-TWS-FP0006 and 9.5.0-TIV-TWS-FP0001.
For these affected releases IJ14588, supersedes IJ00716, IV91052, IV85683, IV82641, IV71646, IV70763, IV66395, IV66398, IV62010, IV61392, IV75062, IJ07385, IJ11456.
For Unsupported releases IBM recommends upgrading to a fixed, supported release of the product.

Workarounds and Mitigations

None