Security Bulletin: Open Source OpenSSL Vulnerabilities in IBM Network Advisor

Summary

Open Source OpenSSL Vulnerabilities in IBM Network Advisor (CVE-2017-3733).

Vulnerability Details

Relevant CVE Information:

CVEID: CVE-2017-3733**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by an error during a renegotiate handshake when the original handshake did not include the Encrypt-Then-Mac extension. A remote authenticated attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/122091 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

IBM Network Advisor prior to release 14.0.2

Remediation/Fixes

Fixed in IBM Network Advisor 14.0.2

Workarounds and Mitigations

NA