| Package | Affected versions | Patched versions |
|---|---|---|
| big-ip access policy manager | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip advanced firewall manager | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip analytics | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip application acceleration manager | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip application security manager | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip domain name system | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip edge gateway | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip fraud protection service | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip global traffic manager | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip link controller | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip local traffic manager | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip policy enforcement manager | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-ip webaccelerator | ≥ 12.1.0, ≤ 12.1.5≥ 13.0.0, ≤ 13.1.3≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.1.0 | |
| big-iq centralized management | ≥ 6.0.0, ≤ 6.1.0≥ 7.0.0, ≤ 7.1.0 | |
| traffix signaling delivery controller | = 4.4.0≥ 5.0.0, ≤ 5.1.0 | |
| agent | ≥ 5.6.0, ≤ 5.6.4 | |
| data exchange layer | ≥ 4.0.0, < 6.0.0 | 6.0.0 |
| threat intelligence exchange server | ≥ 2.0.0, < 3.0.0 | 3.0.0 |
| web gateway | ≥ 7.0.0, < 9.0.0 | 9.0.0 |
| active iq unified manager | ≥ 7.3≥ 9.5 | |
| storagegrid | ≥ 9.0.0, ≤ 9.0.4 | |
| node.js | ≥ 6.0.0, ≤ 6.8.1≥ 6.9.0, < 6.17.0≥ 8.0.0, ≤ 8.8.1≥ 8.9.0, < 8.15.1 | 6.17.08.15.1 |
| openssl | ≥ 1.0.2, < 1.0.2r | 1.0.2r |
| api gateway | = 11.1.2.4.0 | |
| business intelligence | = 11.1.1.9.0= 12.2.1.3.0= 12.2.1.4.0 | |
| communications diameter signaling router | = 8.0.0= 8.1= 8.2= 8.3= 8.4 | |
| communications performance intelligence center | = 10.4.0.2 | |
| communications session border controller | = 7.4= 8.0.0= 8.1.0= 8.2= 8.3 | |
| communications session router | = 7.4= 8.0= 8.1= 8.2= 8.3 | |
| communications unified session manager | = 7.3.5= 8.2.5 | |
| endeca server | = 7.7.0 | |
| enterprise manager base platform | = 12.1.0.5.0= 13.2.0.0.0= 13.3.0.0.0 | |
| enterprise manager ops center | = 12.3.3= 12.4.0 | |
| jd edwards enterpriseone tools | = 9.2 | |
| jd edwards world security | = a9.3= a9.3.1= a9.4 | |
| mysql | ≥ 5.6.0, ≤ 5.6.43≥ 5.7.0, ≤ 5.7.25≥ 8.0.0, ≤ 8.0.15 | |
| mysql enterprise monitor | ≥ 8.0.0, ≤ 8.0.14≤ 4.0.8 | |
| mysql workbench | ≤ 8.0.16 | |
| peoplesoft enterprise peopletools | = 8.55= 8.56= 8.57 | |
| secure global desktop | = 5.4 | |
| services tools bundle | = 19.2 | |
| jboss enterprise web server | = 5.0.0 | |
| virtualization | = 4.0 | |
| virtualization host | = 4.0 | |
| nessus | ≤ 8.2.3 |
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free