CVE-2015-0138

Description

GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	java-1.7.1-ibm +5	1:1.7.1.3.0-1jpp.2.el7_1	RHSA-2015:1020
RHEL 6	java-1.5.0-ibm +6	1:1.5.0.16.10-1jpp.1.el6_6	RHSA-2015:1021
RHEL 6	java-1.6.0-ibm +6	1:1.6.0.16.4-1jpp.1.el6_6	RHSA-2015:1006
RHEL 6	java-1.7.1-ibm +5	1:1.7.1.3.0-1jpp.2.el6_6	RHSA-2015:1020
RHEL 5	java-1.5.0-ibm +7	1:1.5.0.16.10-1jpp.1.el5	RHSA-2015:1021
RHEL 5	java-1.6.0-ibm +7	1:1.6.0.16.4-1jpp.1.el5	RHSA-2015:1006
RHEL 5	java-1.7.0-ibm +5	1:1.7.0.9.0-1jpp.1.el5	RHSA-2015:1007

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Network Satellite 5	java-1.6.0-ibm +1	1:1.6.0.16.4-1jpp.1.el5	RHSA-2015:1091

SUSE