A Security vulnerability has been discovered in OpenSSL that affects the IBM WebSphere Hypervisor Edition v8.5.5.1 on zLinux for SmartCloud Orchestrator tech preview. Other versions of IBM WebSphere Application Server Hypervisor editions are not affected.
CVE-ID:CVE-2014-0160
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability to expose 64k of private memory and retrieve secret keys. This vulnerability can be remotely exploited, authentication is not required and the exploit is not complex. An exploit can only partially affect the confidentially, but not integrity or availability.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92322
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Warning: We strongly encourage you to take action as soon as possible as potential implications to your environment may be more serious than indicated by the CVSS score.
IBM WebSphere Hypervisor Edition v8.5.5.1 on zLinux for SmartCloud Orchestrator
Other versions of IBM WebSphere Application Server Hypervisor Editions are not affected by this vulnerability.
Update the zLinux image from Red Hat
none