Security Bulletin: A security vulnerability has been identified in OpenSSL in IBM® AIX® shipped with IBM PureData System for Operational Analytics ( CVE-2022-1292)

Summary

IBM® AIX® is shipped as a component of IBM PureData System for Operational Analytics. Information about the security vulnerability in OpenSSL affecting IBM AIX has been published in a security bulletin ( CVE-2022-1292).

Vulnerability Details

CVEID:CVE-2022-1292
**DESCRIPTION:**OpenSSL could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the c_rehash script. By sending a specially-crafted request using shell metacharacters, an attacker could exploit this vulnerability to execute arbitrary commands with the privileges of the script on the system.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225619 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

OpenSSL installp packages are available. Please refer to the table below to determine the minimum levels needed.

| Minimum Application Fixpack Version| AIX Fileset Version
—|—|—
OpenSSL| V1.1 FP5| 1.0.2.1206

For instructions on how to apply an IBM PureData System for Operational Analytics fix pack update, refer to PureData System for Operational Analytics fix pack readme documents.

For instructions on how to apply an update using AIX filesets, refer to Updating the system installed IBM® openSSL and openSSH packages in an IBM PureData System for Operational Analytics environment.

Workarounds and Mitigations

None