IBM Initiate Master Data Service is vulnerable to an OpenSSL denial of service attack and could cause the application to crash.
CVEID: CVE-2017-3733**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by an error during a renegotiate handshake when the original handshake did not include the Encrypt-Then-Mac extension. A remote authenticated attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/122091 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
These vulnerabilities are known to affect the following offerings:
IBM Initiate Master Data Service versions 10.0 and 10.1
The recommended solution is to apply the fix as soon as practical. Please see below for information on the fixes available.
Product**** | VRMF | APAR | Remediation/First Fix |
---|---|---|---|
IBM Initiate Master Data Service |
10.0
| None| 10.0.042517_IM_Initiate_MasterDataService_ALL_InterimFix
IBM InfoSphere Master Data Management Patient Hub |
10.0
| None| 10.0.042517_IM_Initiate_Patient_ALL_InterimFix
IBM InfoSphere Master Data Management Provider Hub |
10.0
| None| 10.0.042517_IM_Initiate_Provider_ALL_InterimFix
IBM Initiate Master Data Service|
10.1
| None| 10.1.042517_IM_Initiate_MasterDataService_ALL_InterimFix
None