K86772626 : OpenSSL vulnerability CVE-2015-3194

Security Advisory Description

crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter. (CVE-2015-3194)
Impact
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) (NULL pointer dereference and application crash) by way of an RSA PSS ASN.1 signature. F5 has evaluated this vulnerability as having a high impact on the following components:
BIG-IP

• The Configuration utility
• HTTPS monitors
• iControl SOAP
• iControl REST
  BIG-IQ
• The Configuration utility
• Node.js.
  Note: The BIG-IP Secure Sockets Layer (SSL) profiles do not support RSA-PSS certificate signature validation for virtual server traffic, and are not affected by this vulnerability.