ID

VAR-201404-0592

CVE

CVE-2014-0160

TITLE

OpenSSL TLS heartbeat extension read overflow discloses sensitive information

DESCRIPTION

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. TLS And DTLS In communication OpenSSL The memory contents of the process executing this code may be leaked to the communication partner.An important information such as a private key may be obtained by a remote third party. OpenSSL 1.0.1 and 1.0.2 beta contain a vulnerability that could disclose sensitive private information to an attacker. This vulnerability is commonly referred to as "heartbleed.". HP StoreEver ESL G3 Tape Libraries with MCB rev 2 OpenSSL version1.0.1f for the following firmware versions: 671H_GS00601 665H_GS12501 663H_GS04601 HP StoreEver ESL G3 Tape Libraries with MCB rev 1 Open SSL version 1.0.1e in 655H firmware versions: 655H_GS10201 HP StoreEver Enterprise Library LTO-6 Tape Drives: all firmware versions. This bulletin will be revised when the software updates are released. HP recommends the following mitigation or workaround that can reduce the likelihood of an attacker being able to exploit the "Heartbleed" vulnerability for the HP StoreEver ESL G3 Tape Library and the StoreEver Enterprise Library LTO-6 Tape Drives: The following configuration options that allow access to the Heartbeat function in the vulnerable versions of OpenSSL are not enabled by default. Verify that the following options are "disabled" using the Tape Library GUI: Secure SMI-S CVTL User Note: disabling these features blocks the vulnerable OpenSSL function in both the ESL G3 Tape Library and the StoreEver Enterprise Library LTO-6 Tape Drives. The basic functionality of the library is not affected by these configuration changes and SSL access to the user interface is not blocked by these settings. All users are urged to upgrade their openssl packages (especially libssl1.0.0) and restart applications as soon as possible. According to the currently available information, private keys should be considered as compromised and regenerated as soon as possible. More details will be communicated at a later time. The oldstable distribution (squeeze) is not affected by this vulnerability. For the stable distribution (wheezy), this problem has been fixed in version 1.0.1e-2+deb7u5. For the testing distribution (jessie), this problem has been fixed in version 1.0.1g-1. For the unstable distribution (sid), this problem has been fixed in version 1.0.1g-1. We recommend that you upgrade your openssl packages. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04263236 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04263236 Version: 2 HPSBMU03022 rev.2 - HP Systems Insight Manager (SIM) Bundled Software running OpenSSL, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2014-04-25 Last Updated: 2014-05-13 Potential Security Impact: Remote disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP Systems Insight Management (SIM) bundled software running OpenSSL. The HP SIM software itself is not vulnerable to CVE-2014-0160 ("Heartbleed"). However, the software components bundled with HP SIM are impacted and should be addressed if installed. References: CVE-2014-0160, SSRT101527 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Systems Insight Manager 7.2, 7.2.1, 7.2.2, 7.3, and 7.3.1 bundled with the following software: HP Smart Update Manager (SUM) 6.0.0 through 6.3.0 HP System Management Homepage (SMH) v7.1.2, v7.2, v7.2.1, v7.2.2, v7.3, v7.3.1 for Linux and Windows WMI Mapper for HP Systems Insight Manager v7.2.1, v7.2.2, v7.3, and v7.3.1 HP Version Control Agent (VCA) v7.2.0, v7.2.1, v7.2.2, v7.3.0, and v7.3.1 for Windows HP Version Control Agent (VCA) v7.2.2, v7.3.0, and v7.3.1 for Linux HP Version Control Repository Manager (VCRM) v7.2.0, v7.2.1, v7.2.2, v7.3.0, and v7.3.1 for Windows BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-0160 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has addressed this vulnerability for the impacted software components bundled with HP Systems Insight Manager (SIM) in the following HP Security Bulletins: HP SIM Component HP Security Bulletin Security Bulletin Location HP Smart Update Manager (SUM) HPSBMU02997 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_ na-c04239375 HP System Management Homepage (SMH) HPSBMU02998 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_ na-c04239372 WMI Mapper for HP Systems Insight Manager HPSBMU03013 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_ na-c04260385 HP Version Control Agent (VCA) and Version Control Repository Manager (VCRM) on Linux and Windows, HPSBMU03020 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_ na-c04262472 Note: If customers believe that the SIM installation was compromised while it was running components vulnerable to Heartbleed they need to take the following actions once they have upgraded to the non-vulnerable components. This includes revoking, recreating, and re-importing certificates and resetting passwords that might have been harvested by a malicious attacker using the Heartbleed vulnerability. HP has made the following hot fixes available for SIM v7.2.x that fix the Heartbleed vulnerability: The HP SIM 7.2 Hotfix Kit is available in the following location and is applicable to HP SIM 7.2.x installations. Please read through the readme.txt file before proceeding with the installation. Please click on the HP SIM 7.2 HotFix Kit link to download the hot fix for your operating system platform: http://h18013.www1.hp.com/products/servers/management/hpsim/download.html After installing SIM72_hotfix_2014_Apr_win.exe hotfix, HP Systems Management Homepage has to be manually upgraded if it is already installed on the CMS. HP SMH installer for 32-bit and 64-bit can be found in the CMS under the location SIM_INSTALL_DIR\smartcomponents . The installer filenames are cp023242.exe and cp023243.exe. In case it is suspected that the infrastructure has been compromised, the user needs to create new HP SIM Server certificate and Single Sign-on (sso) certificates. To create new server and sso certificates, refer the HP SIM 7.2 Command Line Interface guide which can be found in the below URL: ttp://h17007.www1.hp.com/us/en/enterprise/servers/solutions/info-library/inde x Refer to the mxcert command section which has the details to create new server and sso certificates. Once the new server certificate is created, it will invalidate any trust relationship between CMS and any other system that depend on this certificate, such as browsers. The user must re-establish the trust between CMS and other system that uses this certificate, and revoke any previous SIM certificates from any device previously configured to trust SIM (Onboard Administrator, Virtual Connect Module, iLOs, and SMH instances). Once the new sso certificate is created, the user must re-establish the trust between HP SIM and managed devices (HP SMH, ILO, OA. VC) for Single Sign-on to work. To reestablish trust with the sso certificate, refer to HP SIM 7.2 user guide and HP SIM Online help (under security section). HP SIM 7.2 user guide is located in the below URL: http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c03651392-3.pdf HP SIM 7.3 user guide is located in the below URL: http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c04030739-2.pdf CMS Reconfigure Tool (aka mxrefconfig) In case it is suspected that CMS OS credentials are also compromised, then it is recommended that credentials are changed. The SIM User Guide (Chapter 19 CMS Reconfigure Tool pg 93) provides two procedures to change the service account password along with other related accounts. The procedures to follow are: Procedure 18 - Changing the CMS password for HP SIM and Insight Control Procedure 19 - Changing CMS password for Matrix OE and Operations Orchestration Note: if the customer has Insight Control server deployment installed, procedures to change the password are documented in the HP Insight Control Server Deployment User Guide. Frequently Asked Questions: Will updated systems require a reboot after applying the SIM hotfix? No, reboot of the system will not be required. Installing the new build would be sufficient to get back to the normal state. Will new certificates be issued along with the patch, or need to be handled separately? If you suspect the certificate has been compromised due to this vulnerability, we do recommend creating new certificates for server and Single Sign-on and revoking previous certificates. Instructions on creating new certificate and re-establishing trust between CMS and managed devices are in the notes above. - From where can I get HP SIM documentation? All major documents are available at: http://h17007.www1.hp.com/us/en/enterprise/servers/solutions/info-library/ind ex.aspx?cat=insightmanagement&subcat=sim#.U2yioSi20tM HISTORY Version:1 (rev.1) - 25 April 2014 Initial release Version:2 (rev.2) - 13 May 2014 Added additional remediation steps and v7.2 Hotfix Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. After the protocols have been disabled, change the user passwords on the array. Until the software update is available, HP recommends limiting 3PAR OS Management Tools to use only on a secure and isolated private management network. Please check the following security bulletins for each of these and the additional HP products. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-0160 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided firmware updates that address this vulnerability. Please see the table below. To obtain the updated firmware, follow the below steps to obtain the firmware Update. Obtain the firmware update from www.hp.com/go/support Select "Drivers & Downloads". Enter the product name listed in the table below into the search field. Click on "Go". Click on the appropriate product. Under "Select operating system" select any Windows operating system from the list. Select the appropriate firmware update under "Firmware". Product Name Model Number Firmware Revision HP Officejet Pro X451dn Printer CN459A BNP1CN1409BR HP Officejet Pro X451dw Printer CN463A BWP1CN1409BR HP Officejet Pro X551dw Printer CV037A BZP1CN1409BR HP Officejet Pro X476dn Multifunction Printer CN460A LNP1CN1409BR HP Officejet Pro X476dw Multifunction Printer CN461A LWP1CN1409BR HP Officejet Pro X576dw Multifunction Printer CN598A LZP1CN1409BR HP Officejet Pro 276dw Multifunction Printer CR770A FRP1CN1416BR HP Officejet Pro 251dw Printer CV136A EVP1CN1416BR HP Officejet Pro 8610 e-All-in-One Printer A7F64A FDP1CN1416AR HP Officejet Pro 8615 e-All-in-One Printer D7Z36A FDP1CN1416AR HP Officejet Pro 8620 e-All-in-One Printer A7F65A FDP1CN1416AR HP Officejet Pro 8625 e-All-in-One Printer D7Z37A FDP1CN1416AR HP Officejet Pro 8630 e-All-in-One Printer - A7F66A FDP1CN1416AR HP Officejet Pro 8640 e-All-in-One Printer E2D42A FDP1CN1416AR HP Officejet Pro 8660 e-All-in-One Printer E1D36A FDP1CN1416AR HISTORY Version:1 (rev.1) - 30 April 2014 Initial release Version:2 (rev.2) - 12 May 2014 Added additional HP Officejet Pro 86xx printers to table Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. HP initially addressed this vulnerability by issuing update v8.01 on 30-April-2014. It was determined that v8.01 incompletely addressed the vulnerability, and so HP customers should apply v8.02. All other HP CloudSystem Foundation and HP CloudSystem Enterprise software download files remain at version 8.0. The combination of these files available at the link above makes up the overall CloudSystem solution. Customers who had downloaded a version of CloudSystem prior to this most recent update are encouraged to obtain the updated files from the Software Depot download location. HP recommends that customers with software support for HP CloudSystem Foundation or HP CloudSystem Enterprise, and have installed a version prior to v8.02, contact HP Technical Support to help determine the best method to proceed. HP CloudSystem Matrix 7.3 Update 1 v7.3.1.0 and HP CloudSystem built on ConvergedSystem 700x solutions support customers moving from OA 4.11 to OA 4.12. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:123 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : tor Date : June 11, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated tor packages fix multiple vulnerabilities: Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for relay identity keys and hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors (CVE-2013-7295). Update to version 0.2.4.22 solves these major and security problems: - Block authority signing keys that were used on authorities vulnerable to the heartbleed bug in OpenSSL (CVE-2014-0160). - Fix a memory leak that could occur if a microdescriptor parse fails during the tokenizing step. - The relay ciphersuite list is now generated automatically based on uniform criteria, and includes all OpenSSL ciphersuites with acceptable strength and forward secrecy. - Relays now trust themselves to have a better view than clients of which TLS ciphersuites are better than others. - Clients now try to advertise the same list of ciphersuites as Firefox 28. For other changes see the upstream change log _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7295 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160 http://advisories.mageia.org/MGASA-2014-0059.html http://advisories.mageia.org/MGASA-2014-0256.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 77035fd2ff3c6df5effbaf9ee78bdaf4 mbs1/x86_64/tor-0.2.4.22-1.mbs1.x86_64.rpm cccaec1a8425ebfce0bb7d8057d38d6e mbs1/SRPMS/tor-0.2.4.22-1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Multiple Vulnerabilities in Cisco ASA Software Advisory ID: cisco-sa-20140409-asa Revision 1.0 For Public Release 2014 April 9 16:00 UTC (GMT) Summary ======= Cisco Adaptive Security Appliance (ASA) Software is affected by the following vulnerabilities: Cisco ASA ASDM Privilege Escalation Vulnerability Cisco ASA SSL VPN Privilege Escalation Vulnerability Cisco ASA SSL VPN Authentication Bypass Vulnerability Cisco ASA SIP Denial of Service Vulnerability These vulnerabilities are independent of one another; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of the Cisco ASA ASDM Privilege Escalation Vulnerability and the Cisco ASA SSL VPN Privilege Escalation Vulnerability may allow an attacker or an unprivileged user to elevate privileges and gain administrative access to the affected system. Successful exploitation of the Cisco ASA SSL VPN Authentication Bypass Vulnerability may allow an attacker to obtain unauthorized access to the internal network via SSL VPN. Successful exploitation of the Cisco ASA SIP Denial of Service Vulnerability may cause the exhaustion of available memory. This may cause system instability and in some cases lead to a reload of the affected system, creating a denial of service (DoS) condition. Workarounds that mitigate these vulnerabilities are available for some of the vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CA20140413-01: Security Notice for OpenSSL Heartbleed Vulnerability Issued: April 13, 2014 Updated: May 12, 2014 CA Technologies is investigating an OpenSSL vulnerability, referred to as the "Heartbleed bug" that was publicly disclosed on April 7, 2014. CVE identifier CVE-2014-0160 has been assigned to this vulnerability. CA Technologies has confirmed that the majority of our product portfolio is unaffected. There are, however, several products that used vulnerable versions of OpenSSL 1.0.1 and consequently may be affected. CA Technologies will update this security notice as additional information becomes available. Risk Rating High These products may be affected CA ARCserve D2D for Windows 16.5 CA ARCserve D2D for Linux 16.5, 16.5SP1 CA ARCserve High Availability 16.5, 16.5SP1, 16.5SP2 (SP2 build less than 3800) CA ARCserve Replication 16.5, 16.5SP1, 16.5SP2 (SP2 build less than 3800) CA ARCserve Unified Data Protection (Release Candidate) CA ecoMeter 3.1.1, 3.1.2, 4.0.00, 4.0.01, 4.0.02, 4.1.00, 4.1.01, 4.2.00 CA eHealth 6.3.0.05 thru 6.3.2.04 (all platforms affected) CA Layer 7 API Gateway 8.1 (installed but not used by default) CA Layer 7 API Portal 2.6 CA Layer 7 Mobile Access Gateway 8.1 (installed but not used by default) CA Mobile Device Management 2014 Q1 CA XCOM Data Transport - Only the Windows 64-bit XCOM application is affected. Note: At this time, no other CA Technologies products have been identified as potentially vulnerable. Solution CA ARCserve D2D for Windows 16.5: Apply fix RO69431. CA ARCserve D2D for Linux 16.5 and 16.5SP1: Apply fix RO69417. Note that r16.5 SP1 is a prerequisite for this fix. CA ARCserve High Availability 16.5, 16.5SP1, 16.5SP2 (SP2 build less than 3800): Apply Service Pack 2 (build 3800), which includes the fix for the OpenSSL Heartbleed vulnerability: RI69547. CA ARCserve Replication 16.5, 16.5SP1, 16.5SP2 (SP2 build less than 3800): Apply Service Pack 2 (build 3800), which includes the fix for the OpenSSL Heartbleed vulnerability: RI69547. CA ARCserve Unified Data Protection (Release Candidate): CA expects to provide a solution with the GA release on May 14, 2014 CA ecoMeter 3.1.1, 3.1.2: These versions of CA ecoMeter use eHealth as the data collection platform. Apply the appropriate fix listed below. Important note: Do not apply this patch to CA eHealth releases prior to 6.3.0.05 and/or systems utilizing CAC. Customers who use eHealth with CAC should wait for further notification as the testing for that configuration has not been completed. Windows: RO69554 Linux: RO69556 Solaris: RO69555 CA ecoMeter 4.0.00, 4.0.01, 4.0.02, 4.1.00, 4.1.01, 4.2.00: These versions of CA ecoMeter use eHealth as the data collection platform. Apply the appropriate fix listed below. Important note: The current CA eHealth / CA SiteMinder integration is not compatible with release 6.3.1.02 thru 6.3.2.04. Do not apply this patch to CA eHealth released prior to 6.3.1.02 and/or system utilizing CAC. Customers who use eHealth with CAC should wait for further notification as the testing for that configuration has not been completed. Windows: RO69442 Linux: RO69443 Solaris: RO69444 CA eHealth 6.3.0.05 - 6.3.1.01 (all platforms): Apply the appropriate fix listed below. Important note: Do not apply this patch to CA eHealth releases prior to 6.3.0.05 and/or systems utilizing CAC. Customers who use eHealth with CAC should wait for further notification as the testing for that configuration has not been completed. Windows: RO69554 Linux: RO69556 Solaris: RO69555 CA eHealth 6.3.1.02 - 6.3.2.04 (all platforms): Apply the appropriate fix listed below. Important note: The current CA eHealth / CA SiteMinder integration is not compatible with release 6.3.1.02 thru 6.3.2.04. Do not apply this patch to CA eHealth released prior to 6.3.1.02 and/or system utilizing CAC. Customers who use eHealth with CAC should wait for further notification as the testing for that configuration has not been completed. Windows: RO69442 Linux: RO69443 Solaris: RO69444 CA Layer 7 API Gateway 8.1: Solution was delivered on April 10, 2014 Refer to the Layer 7 Technologies Support site for solution. CA Layer 7 API Portal 2.6: Solution was delivered on April 10, 2014 Refer to the Layer 7 Technologies Support site for solution. CA Layer 7 Mobile Access Gateway 8.1: Solution was delivered on April 10, 2014 Refer to the Layer 7 Technologies Support site for solution. CA Mobile Device Management 2014 Q1: Apply Hotfix 1: CA MDM 2014Q1 Hotfix 1 CA XCOM Data Transport (only Windows 64-bit platform is affected): Solution RO69230 was published on April 11, 2014 Workaround None References CVE-2014-0160 - OpenSSL Heartbleed vulnerability Change History v1.0: 2014-04-13, Initial Release v1.1: 2014-04-14, Updated Layer 7 affected products and solution. v1.2: 2014-04-14, Updated XCOM Data Transport affected product info. v1.3: 2014-04-19, Modified affected versions for ARCserve D2D for Windows, ARCserve High Availability, ARCserve Replication, eHealth. Added ecoMeter to affected products. Modified solutions for ARCserve D2D for Windows, ARCserve D2D for Linux, ARCserve High Availability, ARCserve Replication, eHealth. Added ecoMeter 3.x and 4.x solution information. Added fixes for eHealth 6.3.1.02 – 6.3.2.04, and ecoMeter 4.x. v1.4: 2014-04-24, Modified ARCserve RHA affected versions. Added solutions for ARCserve D2D (Windows and Linux), ARCserve RHA, ecoMeter, eHealth. v1.5: 2014-05-12, Added fix for MDM. Fixes are now available for all potentially affected CA products. If additional information is required, please contact CA Technologies Support at https://support.ca.com/ . If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team at vuln@ca.com . PGP key: support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782 Security Notices https://support.ca.com/irj/portal/anonymous/phpsbpldgpg Regards, Ken Williams Director, Product Vulnerability Response Team CA Technologies | One CA Plaza | Islandia, NY 11749 | www.ca.com Ken.Williams@ca.com | vuln@ca.com Copyright © 2014 CA. All Rights Reserved. One CA Plaza, Islandia, N.Y. 11749. All other trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. -----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.2 (Build 15238) Charset: utf-8 wj8DBQFTdhtEeSWR3+KUGYURAqHSAJ9DSbzijtuMxwyes6kJ21iJwHkXVQCZARiM GEWBqKGKzMXNkvtf/sUGm1Q= =C6WK -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

bypass

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

HP

SOURCES

LAST UPDATE DATE

2026-08-09T22:49:46.856000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE