Security Bulletin: IBM Platform Analytics is affected by a vulnerability(CVE-2015-7575)

Summary

Java specific advisory for SLOTH - Weak MD5 Signature Hash - For use only when affected by Java and/or when consuming products affected by Java was addressed by IBM Platform Analytics Express,Standard and Advanced Edition.

Vulnerability Details

CVEID: CVE-2015-7575 **
DESCRIPTION:** The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109415 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Affected Products and Versions

Platform Analytics 9.1.2.x

Remediation/Fixes

see workarounds

Workarounds and Mitigations

Fix is by upgrading to PA 9.1.2.3