Security Bulletin: This Power System update is being released to address CVE-2020-1968

Summary

POWER9: In response to a security issue with FSP’s ASMi web GUI connection via OpenSSL a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2020-1968

Vulnerability Details

CVEID:CVE-2020-1968
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite, an attacker could exploit this vulnerability to eavesdrop on all encrypted communications sent over that TLS connection.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187977 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Firmware release FW940 and FW950 are affected.

Remediation/Fixes

Customers with the products below, install FW950.40 or above.

1. IBM Power System S922 (9009-22A)

2. IBM Power System H922 (9223-22H)

3. IBM Power System S914 (9009-41A)

4. IBM Power System S924 (9009-42A)

5. IBM Power System H924 (9223-42H)

6. IBM Power System L922 (9008-22L)

7. IBM Power System S914 (9009-41G)

8. IBM Power System S922 (9009-22G)

9. IBM Power System S924(9009-42G)

10. IBM ESS 5000 Server (5105-22E)

11. IBM Power System E950 (9040-MR9)

12)IBM Power System E980 (9080-M9S)

Workarounds and Mitigations

None