OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational RequisitePro. RequisitePro has addressed the applicable CVEs.
CVEID: CVE-2015-0209**
DESCRIPTION:** OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error in the d2i_ECPrivateKey or EVP_PKCS82PKEY function. An attacker could exploit this vulnerability to corrupt memory and execute arbitrary code on the system and cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101674 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVEID: CVE-2015-0286**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by an error in the ASN1_TYPE_cmp function when attempting to compare ASN.1 boolean types. An attacker could exploit this vulnerability to crash any certificate verification operation and cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101666 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2015-0289**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by the failure to properly handle missing outer ContentInfo by the PKCS#7 parsing code. An attacker could exploit this vulnerability using a malformed ASN.1-encoded PKCS#7 blob to trigger a NULL pointer dereference.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101669 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
IBM Rational RequisitePro versions:
Version
|
Status
—|—
7.1.4 through 7.1.4.7
|
Affected
7.1.3 through 7.1.3.14
|
Affected
7.1.2 through 7.1.2.17
|
Affected
7.1.1.x (all versions)
|
Affected
Not all deployments of Rational RequisitePro use OpenSSL in a way that is affected by these vulnerabilities.
You are vulnerable if your use of Rational RequisitePro includes any of these configurations:
Affected Versions
|
** Prerequisite before applying the fix**
—|—
7.1.4 through 7.1.4.7
| Install Rational RequisitePro Fix Pack 8 (7.1.4.8) for 7.1.4
7.1.3 through 7.1.3.14
| Install Rational RequisitePro Fix Pack 15 (7.1.3.15) for 7.1.3
7.1.2.x (all fix packs)
7.1.1.x (all fix packs)
7.1.0.x (all fix packs)
| Install Rational RequisitePro Fix Pack 18 (7.1.2.18) for 7.1.2. **Note:**7.1.2.18 interoperates with all 7.1.x.x systems, and can be installed in the same way as 7.1.x.x fix packs.
You should verify applying this fix does not cause any compatibility issues.
For unsupported versions, IBM recommends upgrading to a fixed, supported version/release/platform of the product.
Disable the integrations and any custom defined ratlperl or cqperl scripts with SSL until you apply the fixes listed above.