OpenSSL Multiple Vulnerabilities in RSA products

EMC CONFIDENTIAL ? SUBJECT TO CONFIDENTIALITY PROVISIONS IN LICENSE AGREEMENT

Impact: The OpenSSL project released a security advisory on June 5, 2014 disclosing multiple vulnerabilities in OpenSSL. It can be found at

https://www.openssl.org/news/secadv_20140605.txt

These issues have the following CVEs:

• SSL/TLS MITM vulnerability - CVE-2014-0224
• DTLS recursion flaw - CVE-2014-0221
• DTLS invalid fragment vulnerability - CVE-2014-0195
• SSL_MODE_RELEASE_BUFFERS NULL pointer deference - CVE-2014-0198
• SSL_MODE_RELEASE_BUFFERS session injection or denial of service - CVE-2010-5298
• Anonymous ECDH denial of service - CVE-2014-3470
• FLUSH+RELOAD cache side-channel attack - CVE-2014-0076

These issues apply to:

• OpenSSL versions prior to 0.9.8za
• OpenSSL version 1.0.0 prior to version 1.0.0m
• OpenSSL version 1.0.1 prior to version 1.0.1h

Resolution: RSA is aware of this issue and working with product organizations to investigate the issue and identify the impact. The impact of these

vulnerabilities on RSA products may vary depending on the affected product.

This table will be updated as additional information becomes available.