Is DX NetOps Performance Management vulnerable to CVE-2023-48795

Products

• DX NetOps
• CA Performance Management - Usage and Administration

Issue/Introduction

CVE-2023-48795 -  SSH Terrapin Prefix Truncation Weakness

Affects some versions of ssh

Is Performance Management vulnerable?

Environment

Performance Management: All Supported Versions

Resolution

We do not ship OpenSSH in any capacity with the Performance Management product.  So we are not vulnerable in that sense.

However, since OpenSSH is likely on the machines that Performance Management is installed on -

this should be addressed by the system admin, and updating the package would not affect PM.

Additional Information

https://access.redhat.com/security/cve/cve-2023-48795