Vulnerability in IBM Websphere Application Server

CVE-2012-2190

IBM Global Security Kit (aka GSKit), as used in IBM HTTP Server in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1, allows remote attackers to cause a denial of service (daemon crash) via a crafted ClientHello message in the TLS Handshake Protocol.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.024 (82.1th percentile) — read the EPSS interpretation.

Affected products

Ibm Websphere_application_server — versions 6.1.0, 6.1.0.0, 6.1.0.1
N/a — versions n/a

Weakness classification (CWE)

CWE-310 — Cryptographic Issues

References

psirt@us.ibm.com (vdb-entry, x_refsource_XF)
psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (vendor-advisory, x_refsource_AIXAPAR)