Security Bulletin
Summary
OpenSSL vulnerabilities CVE-2019-1559 and CVE-2018-5407 were disclosed by the OpenSSL Project. OpenSSL is used by IBM Workload Manager. IBM Workload Manager has addressed the applicable CVEs
Vulnerability Details
CVE-ID: CVE-2018-5407
Description: Multiple SMT/Hyper-Threading architectures and processors could allow a local attacker to obtain sensitive information, caused by execution engine sharing on Simultaneous Multithreading (SMT) architecture. By using the PortSmash new side-channel attack, an attacker could run a malicious process next to legitimate processes using the architecture’s parallel thread running capabilities to leak encrypted data from the CPU's internal processes.
Note: This vulnerability is known as PortSmash.
CVSS Base Score: 5.1
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/152484 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Description: Multiple SMT/Hyper-Threading architectures and processors could allow a local attacker to obtain sensitive information, caused by execution engine sharing on Simultaneous Multithreading (SMT) architecture. By using the PortSmash new side-channel attack, an attacker could run a malicious process next to legitimate processes using the architecture’s parallel thread running capabilities to leak encrypted data from the CPU's internal processes.
Note: This vulnerability is known as PortSmash.
CVSS Base Score: 5.1
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/152484 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVE-ID: CVE-2019-1559
Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding. An attacker could exploit this vulnerability using a 0-byte record padding-oracle attack to decrypt traffic.
CVSS Base Score: 5.8
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/157514 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding. An attacker could exploit this vulnerability using a 0-byte record padding-oracle attack to decrypt traffic.
CVSS Base Score: 5.8
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/157514 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Affected Products and Versions
IBM Workload Scheduler uses OpenSSL only for secure communication between internal processes.
For IBM Workload Scheduler Distributed, Workload Scheduler nodes are impacted by OpenSSL security exposures only if the IWS workstation has been defined with “securitylevel” set to on or enabled or force.
These security exposures do not apply to WebSphere Application Server but only to programs installed under <TWS home>/bin.
For IBM Workload Scheduler Distributed, Workload Scheduler nodes are impacted by OpenSSL security exposures only if the IWS workstation has been defined with “securitylevel” set to on or enabled or force.
These security exposures do not apply to WebSphere Application Server but only to programs installed under <TWS home>/bin.
The following IBM Workload Scheduler releases are potentially affected:
Tivoli Workload Scheduler Distributed 9.2.0 FP03 and earlier
IBM Workload Scheduler Distributed 9.3.0 FP03 and earlier
IBM Workload Scheduler Distributed 9.4.0 FP05 and earlier
Tivoli Workload Scheduler Distributed 9.2.0 FP03 and earlier
IBM Workload Scheduler Distributed 9.3.0 FP03 and earlier
IBM Workload Scheduler Distributed 9.4.0 FP05 and earlier
IBM Workload Scheduler Distributed 9.5.0 GA
Remediation/Fixes
APAR IJ14588 has been opened to address the openssl vulnerabilities for IBM Workload Scheduler.
The following limited availability fixes for IJ14588 are available for download on FixCentral
9.2.0-TIV-TWS-FP0003-IJ14588
to be applied on top of Tivoli Workload Scheduler Distributed 9.2.0 FP03
9.3.0-TIV-TWS-FP0003-IJ14588
to be applied on top of Tivoli Workload Scheduler Distributed 9.3.0 FP03
APAR IJ14588 has been included in 9.4.0-TIV-TWS-FP0006 and 9.5.0-TIV-TWS-FP0001.
For these affected releases IJ14588, supersedes IJ00716, IV91052, IV85683, IV82641, IV71646, IV70763, IV66395, IV66398, IV62010, IV61392, IV75062, IJ07385, IJ11456.
For Unsupported releases IBM recommends upgrading to a fixed, supported release of the product.
The following limited availability fixes for IJ14588 are available for download on FixCentral
9.2.0-TIV-TWS-FP0003-IJ14588
to be applied on top of Tivoli Workload Scheduler Distributed 9.2.0 FP03
9.3.0-TIV-TWS-FP0003-IJ14588
to be applied on top of Tivoli Workload Scheduler Distributed 9.3.0 FP03
APAR IJ14588 has been included in 9.4.0-TIV-TWS-FP0006 and 9.5.0-TIV-TWS-FP0001.
For these affected releases IJ14588, supersedes IJ00716, IV91052, IV85683, IV82641, IV71646, IV70763, IV66395, IV66398, IV62010, IV61392, IV75062, IJ07385, IJ11456.
For Unsupported releases IBM recommends upgrading to a fixed, supported release of the product.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Off
Change History
September 6th 2019: Original Version Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SS8GJD","label":"IBM Workload Automation"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"9.2.0.0, 9.3.0.0, 9.4.0.0, 9.5.0.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
Product Synonym
TWS; IWS
Was this topic helpful?
Document Information
Modified date:
19 June 2020
UID
ibm11072932