Solved: Thanks for the quick reply

gregkoerner · ‎12-12-2014

Greetings - The C40 I have running 5.1.13 continues to be flagged by my security team for:

CVE-2014-0221

CVE-2014-0195

CVE-2014-3470

I was under the impression that 5.1.13 would fix the open SSL problems. Is this not the case? Has anyone else had similar issues or implemented any workarounds?

Patrick Sparkman · ‎12-12-2014

All 3 security issues are addressed in this advisory: cisco-sa-20140605-openssl. The bug in that advisory for C Series codecs CSCup25163 says it resolves CVE-2014-3470, but doesn't mention the other two. They could be fixed in the versions noted in the bug, which are TC6.0.3 and TC7.1.4, though not documented since I only found a reference to 3470 in the release notes, or it could be that a fix might still be pending for the others.

View solution in original post

Patrick Sparkman · ‎12-12-2014

All 3 security issues are addressed in this advisory: cisco-sa-20140605-openssl. The bug in that advisory for C Series codecs CSCup25163 says it resolves CVE-2014-3470, but doesn't mention the other two. They could be fixed in the versions noted in the bug, which are TC6.0.3 and TC7.1.4, though not documented since I only found a reference to 3470 in the release notes, or it could be that a fix might still be pending for the others.

gregkoerner · ‎12-12-2014

Thanks for the quick reply Patrick.

C40 Flagged by Security