Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMF7BEDAF8C9D9CA56CF39646FDE72AEACB1EC9C1177F6655AA0CA0AC6691BD3DD
HistoryMar 02, 2020 - 4:40 p.m.

Security Bulletin: OpenSSL publicly disclosed vulnerability

2020-03-0216:40:29
www.ibm.com
8

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:N/I:P/A:N

JSON

Summary

IBM MobileFirst Platform Foundation has addressed the following vulnerability(ies) by updating the version of OpenSSL.

Vulnerability Details

CVEID:CVE-2019-1552
**DESCRIPTION:**OpenSSL could allow a local attacker to bypass security restrictions, caused by the building of . mingw programs or Windows programs with world writable path defaults. An attacker could exploit this vulnerability to modify default configuration, insert CA certificates, modify (or even replace) existing engine modules.
CVSS Base score: 2.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/164498 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM MobileFirst Platform Foundation 7.1.0.0
IBM MobileFirst Foundation 8.0.0.0

Remediation/Fixes

Published artifacts with the fix
iOS Native SDK - 8.0.2020021915
Android Native SDK - 8.0.2019103109
Cordova SDK - 8.0.2020022009

MF v7.1 - 7.1.0.0-IF202002241356

Workarounds and Mitigations

None

Related

ibm 26
nessus 19
openvas 21
cve 1
osv 1
ubuntucve 1
prion 1
openssl 1
redhatcve 1
veracode 1
f5 1
debiancve 1
pentestit 1
cert 1
hackerone 2
altlinux 4
fedora 3
symantec 1
ics 1
oracle 5
ibm
ibm
Security Bulletin: Vulnerability in OpenSSL library affect OS Pattern Kit used in IBM Cloud Pak System
2020-07-07 16:58:06
Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise (CVE-2019-1552)
2020-12-09 11:27:21
Security Bulletin: Security Vulnerability in OpenSSL affect IBM Netezza Analytics
2020-02-11 06:43:42
nessus
nessus
EulerOS 2.0 SP3 : openssl1.1.0f (EulerOS-SA-2019-2005)
2019-09-24 00:00:00
EulerOS 2.0 SP3 : openssl (EulerOS-SA-2019-2642)
2019-12-18 00:00:00
EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2019-1862)
2019-09-17 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2019-2642)
2020-01-23 00:00:00
OpenSSL Default Installation Paths Vulnerability (CVE-2019-1552) - Windows
2019-08-14 00:00:00
Huawei EulerOS: Security Advisory for openssl1.1.0f (EulerOS-SA-2019-2005)
2020-01-23 00:00:00
cve
cve
CVE-2019-1552
2019-07-30 17:15:00
osv
osv
CVE-2019-1552
2019-07-30 17:15:12
ubuntucve
ubuntucve
CVE-2019-1552
2019-07-30 00:00:00
prion
prion
Default configuration
2019-07-30 17:15:00
openssl
openssl
Vulnerability in OpenSSL CVE-2019-1552
2019-07-30 00:00:00
redhatcve
redhatcve
CVE-2019-1552
2019-08-26 14:59:31
veracode
veracode
Insecure Path Defaults
2019-07-31 07:19:43
f5
f5
K94041354 : OpenSSL vulnerability CVE-2019-1552
2019-10-07 00:00:00
debiancve
debiancve
CVE-2019-1552
2019-07-30 17:15:00
pentestit
pentestit
UPDATE: Nmap 7.80
2019-08-12 21:59:41
cert
cert
Veritas Backup Exec is vulnerable to privilege escalation due to OPENSSLDIR location
2020-12-23 00:00:00
hackerone
hackerone
curl: curl on Windows can be forced to execute code via OpenSSL environment variables
2019-10-14 23:02:51
Internet Bug Bounty: Windows builds with insecure path defaults (CVE-2019-1552)
2019-08-28 00:18:59
altlinux
altlinux
Security fix for the ALT Linux 9 package openssl10 version 1.0.2u-alt1.p9.1
2020-12-10 00:00:00
Security fix for the ALT Linux 8 package openssl10 version 1.0.2u-alt0.M80P.1
2020-12-11 00:00:00
Security fix for the ALT Linux 10 package openssl1.1 version 1.1.1d-alt1
2019-09-19 00:00:00
fedora
fedora
[SECURITY] Fedora 29 Update: compat-openssl10-1.0.2o-7.fc29
2019-09-26 01:41:32
[SECURITY] Fedora 31 Update: compat-openssl10-1.0.2o-8.fc31
2019-09-21 00:04:14
[SECURITY] Fedora 30 Update: compat-openssl10-1.0.2o-7.fc30
2019-09-25 01:08:23
symantec
symantec
OpenSSL Vulnerabilities Oct 2018 - Jul 2019
2019-09-05 08:00:00
ics
ics
Siemens SCALANCE X-200RNA Switch Devices
2022-12-19 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2019
2020-01-22 00:00:00
Oracle Critical Patch Update Advisory - January 2020
2020-01-14 00:00:00
Oracle Critical Patch Update Advisory - October 2020
2020-10-20 00:00:00

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:N/I:P/A:N

JSON
Related for F7BEDAF8C9D9CA56CF39646FDE72AEACB1EC9C1177F6655AA0CA0AC6691BD3DD
ibm26nessus19openvas21cve1osv1ubuntucve1prion1openssl1redhatcve1veracode1f51debiancve1pentestit1cert1hackerone2altlinux4fedora3symantec1ics1oracle5