Security Announcement-Statement on OpenSSL Encryption Vulnerability CVE-2012-2686
09-09-2020
Overview
crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via crafted CBC data. This vulnerability is numbered CVE-2012-2686.
Analysis has confirmed that H3C equipment is not affected by this vulnerability.
Update records
2020-07-20 FINAL
H3C security emergency response external service
H3C advocates that every effort be made to safeguard the ultimate interests of product users, to abide by principles of responsible disclosure of security incidents, and to handle product security issues in accordance with security issues mechanisms. For information on H3C's security emergency response service and H3C product vulnerabilities, please visit https://www.h3c.com/en/Support/Online_Help/psirt/.