Security Bulletin
Summary
There are multiple vulnerabilities in the TLS protocol implementation in Business Automation Insights (BAI) in Cloud Pak for Automation. These have been addressed.
Vulnerability Details
CVEID: CVE-2013-0169
DESCRIPTION: The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/81902 for the current score.
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVEID: CVE-2011-1473
DESCRIPTION: ** DISPUTED ** OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094.NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/71068 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| ICP4A-BAI | 19.0.3 |
Remediation/Fixes
The vulnerabilities referenced above, related to the TLS protocol, have impacted the Business Automation Insights (BAI) component in IBM Cloud Pak for Automation. These have been fixed in the version 19.0.3, released in 2019 Q4.
Workarounds and Mitigations
Customers using previous versions of Cloud Pak for Automation should upgrade to 19.0.3.
Get Notified about Future Security Bulletins
References
Change History
06 Jan 2020: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
06 January 2020
UID
ibm11168306