IT47080: OPENSSL VULNERABILITY FOR THE LIBCRYPTO FILE (LIBCRYPTO-3-X64.DLL) -- CVE-2024-5535

APAR status

• Closed as program error.

Error description

• After upgrading the IBM Control Center to 6.3.1.0_ifix3 version
  the <install directory>\jre\bin\libcrypto-3-x64.dll is using
  OpenSSL version 3.0.14.0 which is vulnerable.
  
  The following is the summary Summary:
  
  OpenSSL is vulnerable to a denial of service, caused by a buffer
  over-read flaw in the SSL_select_next_proto API function when
  calling with an empty supported client protocols buffer. By
  sending a specially crafted request, a remote attacker could
  exploit this vulnerability to cause a crash or memory contents
  to be sent to the peer. This issue affects applications that
  directly call the SSL_select_next_proto function with a 0 length
  list of supported client protocols. The function is typically
  used by TLS applications that support ALPN or NPN. ALPN is
  significantly more widely deployed than NPN. The vulnerability
  can lead to a loss of confidentiality, as up to 255 bytes of
  arbitrary private data from memory may be sent to the peer.
  However, this scenario is not typically under attacker control
  and requires a configuration or programming error in the calling
  application. The severity of this issue is assessed as Low, as
  it is most likely to affect applications using NPN instead of
  ALPN, which is not widely used. Active exploitation is unlikely
  due to the lack of attacker control. The FIPS modules in
  versions 3.3, 3.2, 3.1, and 3.0 are not affected. No new
  releases of OpenSSL are issued at this time, and the fix will be
  included in the next releases. Impact: The vulnerability in
  OpenSSL can be exploited by a remote attacker to cause a denial
  of service by crashing the application or sending memory
  contents to the peer. This can result in unexpected application
  behavior, a crash, or a loss of confidentiality. Up to 255 bytes
  of arbitrary private data from memory may be exposed to the
  peer. However, this vulnerability only affects applications that
  directly call the SSL_select_next_proto function with a 0 length
  list of supported client protocols. The severity of this issue
  is assessed as Low, as it requires a configuration or
  programming error in the calling application and is unlikely to
  be actively exploited. Remediation: Apply the latest patches and
  updates provided by the respective vendors.
  

Local fix

• STRRTC- MFT-16301
  RS/NC
  Circumvention: None
  

Problem summary

• openssl vulnerability for the libcrypto file
  (libcrypto-3-x64.dll) -- CVE-2024-5535
  

Problem conclusion

• upgraded jre to 17.0.12.1
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR CONTROL CEN

• Fixed component ID

  5725D0200

Applicable component levels