A vulnerability has been reported in IBM Lotus Protector for Mail Security, which can be exploited by malicious people to cause a DoS (Denial of Service).
PUBLISH DATE: 13-DEC-2018
A malicious server can send a very long prime value to a client. The client will have to spend a long time generating a key for this prime value. This may cause a hang and lead to Denial of Service.
OpenSSL is vulnerable to a Denial of Service (DoS) vulnerability. During key agreement in a TLS handshake using a DH(E) based ciphersuite, a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished.
This could be exploited in a Denial of Service attack.
Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h).
Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
This is done via the IBM Protector for Mail Security update mechanism. Follow the link for downloading updates for IBM Lotus Protector for mail security.
If you think you’re the victim of a cyber-attack, immediately send an email to firstname.lastname@example.org for a quick response.