IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance

Share this post:

Multiple vulnerabilities in OpenSSL affect all releases of IBM SmartCloud Provisioning 2.1 for IBM Software Virtual Appliance. This bulletin covers also OpenSSL vulnerabilities that were disclosed on March 1, 2016 by the OpenSSL Project inluding the “DROWN: Decrypting RSA with Obsolete and Weakened eNcryption” vulnerability.

CVE(s):CVE-2016-0800, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2016-0705, CVE-2016-0798, CVE-2016-0797, CVE-2016-0799, CVE-2016-0702, CVE-2016-0703, CVE-2016-0704

Affected product(s) and affected version(s):

All releases of IBM SmartCloud Provisioning 2.1 for IBM Software Virtual Appliance are affected.

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg2C1000128
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/111139
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/108503
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/108504
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/108505
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/111140
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/111141
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/111142
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/111143
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/111144
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/111145
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/111146

More stories

IBM Product Security Incident Response

Acknowledgement

May 16, 2022

IBM acknowledges and thanks the security researchers and organizations listed below for reporting and working with us to resolve one or more security vulnerabilities in our products and services. Disclosures for 2022 Credit to Sankk Dahal Christoph Petersen (Linkedin, Twitter) Abhinav Porwal Sagar Chanchal Disclosures for 2021 Keith Lee Credit to Hassan Raza Disclosures for 2020 ...read more


A new and advanced Rowhammer-based attack on DDR4 memory

March 11, 2020

A new and advanced Rowhammer-based attack on DDR4 memory was announced on March 10, 2020. (CVE-2020-10255) The attack has been shown to cause memory corruption in lab environments. Vulnerability exploitation on IBM Power processor architectures, IBM Z-based architectures, IBM Cloud and IBM storage products would be difficult. No customer actions are currently required. IBM Power ...read more


XSA-353 Security Vulnerabilities

November 13, 2019

Security vulnerability CVE-2020-29479 could potentially enable a denial of service attack or allow unauthorized access to the hypervisor, and is addressed by Citrix in XSA-353 security advisories. IBM Cloud has worked with its technology partners to deploy mitigation and remediation measures. There is no known malicious exploit of this vulnerability at this time. ...read more