Security Bulletin: IBM Flex System switch firmware products are affected by a vulnerability in OpenSSL (CVE-2019-1559)

Summary

IBM Flex System switch firmware products have addressed the following OpenSSL vulnerability.

Vulnerability Details

CVEID:CVE-2019-1559
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding. An attacker could exploit this vulnerability using a 0-byte record padding-oracle attack to decrypt traffic.
CVSS Base score: 5.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/157514 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Firmware fix versions are available on Fix Central: <http://www.ibm.com/support/fixcentral/&gt;

Product

|

Fix Version

—|—

IBM Flex System EN2092 1Gb Ethernet Scalable firmware
(ibm_fw_scsw_en2092-7.8.25.0_anyos_noarch)

|

7.8.25.0

IBM Flex System Fabric SI4093 System Interconnect Module firmware
(ibm_fw_scsw_si4093-7.8.25.0_anyos_noarch)

|

7.8.25.0

IBM Flex System Fabric EN4093/EN4093R 10Gb Scalable Switch firmware
(ibm_fw_scsw_en4093r-7.8.25.0_anyos_noarch)

|

7.8.25.0

IBM Flex System Fabric CN4093 10Gb ScSE firmware
(ibm_fw_scsw_cn4093-7.8.25.0_anyos_noarch)

|

7.8.25.0

Workarounds and Mitigations

None