CVE-2015-0534: High severity rsa bsafe vulnerability
EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL-C 2.8.9 and earlier do not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, a similar issue to CVE-2014-8275.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0534?
CVE-2015-0534 has been assigned a medium severity level due to the potential for remote attacks involving certificate data.
How do I fix CVE-2015-0534?
To fix CVE-2015-0534, upgrade the EMC RSA BSAFE Micro Edition Suite to version 4.0.8 or higher, or 4.1.3 or higher, and update the BSAFE SSL libraries to versions 6.2 or later.
What software is affected by CVE-2015-0534?
CVE-2015-0534 affects EMC RSA BSAFE Micro Edition Suite versions prior to 4.0.8 and 4.1.3, along with BSAFE SSL-J before 6.2 and BSAFE SSL-C versions 2.8.9 and earlier.
What kind of attack is possible with CVE-2015-0534?
CVE-2015-0534 allows remote attackers to bypass fingerprint-based certificate validation due to insufficient constraints on certificate data.
Is there a workaround for CVE-2015-0534?
There are no known workarounds for CVE-2015-0534; upgrading to the recommended versions is the only mitigation.