Security Bulletin: z/TPF is affected by the OpenSSL error state security vulnerability

Summary

z/TPF has addressed the OpenSSL error state mechanism security bypass vulnerability.

Vulnerability Details

CVEID:CVE-2017-3737**
DESCRIPTION: *OpenSSL could allow a remote attacker to bypass security restrictions, caused by a flaw in the "error state" mechanism when directly calling SSL_read() or SSL_write() for an SSL object after receiving a fatal error. An attacker could exploit this vulnerability to bypass the decryption or encryption process and perform unauthorized actions.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/136077 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

z/TPF Enterprise Edition Version 1.1.13 - 1.1.14

Remediation/Fixes

Product

| VRMF|APAR|Remediation/First Fix
—|—|—|—
z/TPF| 1.1.13 - 1.1.14| APAR PJ45174| Apply the APAR.

Workarounds and Mitigations

None.