Security Bulletin: Vulnerability in OpenSSL (CVE-2021-3712) affects Power HMC

Summary

OpenSSL is used by IBM Power Hardware Management Console (HMC) for cryptography toolkit implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) network protocols and related cryptography standards required by them. This bulletin provides a remediation for the impacted vulnerability, CVE-2021-3712 by upgrading IBM Power Hardware Management Console (HMC) respective PTF and thus addressing the exposure to the openssl vulnerability.

Vulnerability Details

CVEID:CVE-2021-3712
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read when processing ASN.1 strings. By sending specially crafted data, an attacker could exploit this vulnerability to read contents of memory on the system or perform a denial of service attack.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/208073 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

The following fixes are available on IBM Fix Central at: <http://www-933.ibm.com/support/fixcentral/&gt;

Product

|

VRMF

|

APAR

|

Remediation/Fix

—|—|—|—

Power HMC

|

V9.2.952.0 ppc

|

MB04331

|

MH01925

Power HMC

|

V9.2.952.0 x86

|

MB04330

|

MH01924

Power HMC

|

V10.1.1010.0 ppc

|

MB04335

|

MF69724

Power HMC

|

V10.1.1010.0 x86

|

MB04334

|

MF69722

Workarounds and Mitigations

None