IBM5006DFF250773A422561B82D48E8E760664827EECFA589F4804DD7E99BBA7441Security Bulletin: IBM Aspera On Demand products are affected by OpenSSL Vulnerability (CVE-2019-1552)
0.001 Low
EPSS
Percentile
19.5%
Summary
Aspera Faspex on Demand 3.9.6, Aspera Platform On Demand 3.9.6, Aspera Shares on Demand 3.9.6, Aspera Server on Demand 3.9.6, Aspera Application on Demand 3.9.6 have addressed the following OpenSSL vulnerability.
Vulnerability Details
CVEID:CVE-2019-1552
**DESCRIPTION:**OpenSSL could allow a local attacker to bypass security restrictions, caused by the building of . mingw programs or Windows programs with world writable path defaults. An attacker could exploit this vulnerability to modify default configuration, insert CA certificates, modify (or even replace) existing engine modules.
CVSS Base score: 2.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/164498 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Aspera Faspex on Demand | 3.7.4 |
| Aspera Platform On Demand | 3.7.4 |
| Aspera Shares on Demand | 3.7.4 |
| Aspera Server on Demand | 3.7.4 |
| Aspera Application on Demand | 3.7.4 |
Remediation/Fixes
| Affected Product(s) | Version(s) |
|---|---|
| Aspera Faspex on Demand | 3.9.6 |
| Aspera Platform On Demand | 3.9.6 |
| Aspera Shares on Demand | 3.9.6 |
| Aspera Server on Demand | 3.9.6 |
| Aspera Application on Demand | 3.9.6 |
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm aspera | eq | 3.9.6 |
Related
0.001 Low
EPSS
Percentile
19.5%