IT45263: PSIRT ADV0092629, LOW ISSUE IN OPENSSL - PVR0455596

1.5.0.16190 -AIX- for IBM Sterling Connect:Express for UNIX
1.5.0.16190 -LIN- for IBM Sterling Connect:Express for UNIX
1.5.0.16190 -SOL- for IBM Sterling Connect:Express for UNIX
1.5.0.16180 -SOL- for IBM Sterling Connect:Express for UNIX
1.5.0.16180 -LIN- for IBM Sterling Connect:Express for UNIX
1.5.0.16180 -AIX- for IBM Sterling Connect:Express for UNIX
1.5.0.16170 -AIX- for IBM Sterling Connect:Express for UNIX
1.5.0.16170 -LIN- for IBM Sterling Connect:Express for UNIX
1.5.0.16170 -SOL- for IBM Sterling Connect:Express for UNIX
1.5.0.16160 -SOL- for IBM Sterling Connect:Express for UNIX
1.5.0.16160 -LIN- for IBM Sterling Connect:Express for UNIX
1.5.0.16160 -AIX- for IBM Sterling Connect:Express for UNIX

APAR status

• Closed as program error.

Error description

• Issue reported in OpenSSL package - CVE-2023-3446
  

Local fix

Problem summary

• Connect Express for UNIX uses OpenSSL which is affected by
  CVE-2023-3446
  

Problem conclusion

• OpenSSL package has been upgraded to 1.1.1w. Both CXU iFix and
  OpenSSL updater have been published on Fix Central. Please refer
  iFix 1.5.0.16160. Starting from this iFix, we have introduced
  two security vulnerabilities terms named as Affected and
  Vulnerable. Refer the List of Fixes document on Fix Central for
  more detailed explanation.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR CON EXP UNI

• Fixed component ID

  5725D0001

Applicable component levels