Security Bulletin: Vulnerability in OpenSSL affect Rational Tau (CVE-2016-2180)

Summary

OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by Rational Tau. Rational Tau has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2016-2180**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read in the TS_OBJ_print_bio function. A remote attacker could exploit this vulnerability using a specially crafted time-stamp file to cause the application to crash.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/115829&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

4.3, 4.3.0.1, 4.3.0.2, 4.3.0.3, 4.3.0.4, 4.3.0.5, 4.3.0.6, 4.3.0.6 Interim Fix 1, 4.3.0.6 Interim Fix 2, 4.3.0.6 Interim Fix 3, 4.3.0.6 Interim Fix 4, 4.3.0.6 Interim Fix 5, 4.3.0.6 Interim Fix 6, 4.3.0.6 Interim Fix 7

Remediation/Fixes

Upgrade to Rational Tau Interim Fix 8 for 4.3.0.6

Workarounds and Mitigations

None