Cybersecurity

February 2023 Aspera Vulnerability Patches

At the beginning of February 2023, Aspera announced a vulnerability in some of the Aspera products. This includes:

  • IBM Aspera Orchestrator – Linux and Windows (Versions 4.0.0 and earlier)
  • IBM Aspera faspio Gateway – Linux and Windows (Versions 1.2.1 and earlier)
  • IBM Aspera Faspex – Linux and Windows (Versions 4.4.1 and earlier)

Below, we will go over some of the vulnerability details and the links to the patches to protect against them.

IBM Aspera Orchestrator

For versions 4.0.0 and earlier, there were a few vulnerabilities detected with the OpenSSL. 

For CVE-2021-23839, the OpenSSL could provide weaker-than-expected security due to an incorrect SSLv2 rollback protection that allows for inversion of the logic during a padding check.

For CVE-2021-23840, the OpenSSL is vulnerable to a denial of service caused by an integer overflow in CipherUpdate. An attacker could exploit this vulnerability to cause the application to crash.

For CVE-2021-23841, the OpenSSL is also vulnerable to a denial of service caused by a NULL pointer dereference in the X509 function. This could also lead to an attacker exploiting this vulnerability, causing the application to crash.

To fix this as soon as possible, IBM Aspera Orchestrator users should download the latest version 4.0.1 here. To read the full security bulletin for the OpenSSL vulnerabilities, visit this page.

IBM Aspera faspio Gateway

For versions 1.2.1 and earlier, there were a few vulnerabilities with the OpenSSL that affected IBM Aspera faspio Gateway.

For CVE-2022-3602, the OpenSSL is vulnerable to a stack-based buffer overflow, which is caused by improper bounds checking during X.509 certificate verification. A remote attacker could overflow a buffer and execute arbitrary code or cause the application to crash if using a specially-crafted email address.

For CVE-2022-3786, the OpenSSL is vulnerable to a denial of service caused by a stack-based buffer overflow. With a specialty-crafted email address, a remote attacker could exploit this vulnerability to cause a TLS client to crash.

To fix this as soon as possible, IBM Aspera faspio Gateway users should download the latest version 1.3.1 for their proper platform:

To read the full security bulletin, visit this page.

IBM Aspera Faspex

For versions 4.4.2 and earlier, there were a few vulnerabilities addressed that have been remediated in IBM Aspera Faspex 4.4.2 PL2.

These vulnerabilities include the Apache HTTP Server, cross-site scripting, a YAML deserialization flaw, memory corruption in the deflate operation, and OpenSSL. To read the full security bulletin and which vulnerabilities are associated with which CVEID, visit this page.
To fix this as soon as possible, IBM Aspera Faspex users should download the latest patch for Windows here and for Linux here.

YMP Admin

Recent Posts

Strategies for Backing Up and Recovering Data Effectively

In today’s digital age, the loss of critical data can be devastating. Whether you're a…

3 weeks ago

Data Transfer Protocols Demystified: FTP, SFTP, and HTTP

Transferring files between devices, servers, and networks is a daily necessity for both individuals and…

1 month ago

Cybersecurity Awareness Month 2024: Your Complete Guide

As a trusted partner in cybersecurity, we know just how important it is to stay…

1 month ago

File Transfer Best Practices for Small Businesses

Secure and seamless file transfers can impact your productivity and trustworthiness, whether you’re sharing files…

2 months ago

Top 10 Data Archiving Best Practices

Data archiving is not just about storing files indefinitely; it’s about preserving information that remains…

2 months ago

How to Choose the Right File Transfer Solution for Your Business

No matter the size of your business, transferring files quickly, securely, and efficiently is crucial.…

3 months ago