Security Bulletin: IBM MQ Appliance affected by an OpenSSL vulnerability (CVE-2020-1968)

Summary

IBM MQ Appliance has resolved and OpenSSL vulnerability.

Vulnerability Details

CVEID:CVE-2020-1968
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite, an attacker could exploit this vulnerability to eavesdrop on all encrypted communications sent over that TLS connection.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187977 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under APAR IT36796.

IBM MQ Appliance version 9.1 LTS

Apply fix pack 9.1.0.8, or later firmware.

IBM MQ Appliance version 9.1 CD

Upgrade to 9.2.2 CD release, or later firmware.

Workarounds and Mitigations

None