IBM Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2017-3731)

There is a vulnerability in OpenSSL used by AIX

CVE(s): CVE-2017-3731

Affected product(s) and affected version(s):

 AIX 5.3, 6.1, 7.1, 7.2
VIOS 2.2.x
The following fileset levels are vulnerable:
key_fileset = osrcaix
Fileset Lower Level Upper Level KEY ------------------------------------------------------
openssl.base 1.0.2.500 1.0.2.1000 key_w_fs
openssl.base 20.13.102.1000 20.13.102.1000 key_w_fs
Note: A. 0.9.8, 1.0.1 openSSL versions are out-of-support. Customers are advised
to upgrade to currently supported openSSL 1.0.2 version.
B. Latest level of OpenSSL fileset is available from the web download site:
http://ift.tt/2m4fDa1
To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in the AIX user's guide.
Example: lslpp -L | grep -i openssl.base

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2m46cam
X-Force Database: http://ift.tt/2knsB3D

The post IBM Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2017-3731) appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team http://ift.tt/2m4nlAP