OpenSSL Vulnerabilities (CVE-2014-0224, etc.) and Image Construction Tool Impact Analysis

CVE-ID: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0076 Software Version: 2.3 Operating Systems: AIX, Linux, Windows Impacted by these CVEs: The Image Construction and Composition Tool bundle named "Enablement Bundle for Virtual Applications and System Plugins on Windows" Remediation/Fixes: Remove the mentioned bundle from the Image Construction and Composition Tool to eliminate the vulnerability. Vulnerability Descriptions: - CVE-2014-0224: OpenSSL is vulnerable to a man-in-the-middle attack, caused by weak keying material in SSL/TLS clients and servers. - CVE-2014-0221: OpenSSL is vulnerable to a denial of service due to a recursion error in the DTLS client. - CVE-2014-0195: OpenSSL is vulnerable to a buffer overflow due to invalid DTLS packet fragments. - CVE-2014-0198: OpenSSL is vulnerable to a denial of service due to a NULL pointer dereferencing in the do_ssl3_write() function. - CVE-2010-5298: OpenSSL is vulnerable to a denial of service due to a race condition in the ssl3_read_bytes function. 世 CVE-2014-3470: OpenSSL is vulnerable to a denial of service due to the implementation of anonymous ECDH cipher suites. - CVE-2014-0076: OpenSSL might allow a local attacker to obtain sensitive information due to an implementation error in ECDSA. CVSS Scores: The screenshot provides CVSS Base Scores, Temporal Scores, and Vectors for each CVE-ID.

Goal Reached Thanks to every supporter — we hit 100%!

OpenSSL Vulnerabilities (CVE-2014-0224, etc.) and Image Construction Tool Impact Analysis