Security: Venafi Security Bulletin - 15-001

Published: June 30, 2015

Rating: Critical

Summary:

This security update addresses three Venafi-identified security vulnerabilities that could enable an attacker to gain unauthorized access to Venafi Trust Protection Platform (TPP).

This security update is rated Critical for all currently supported versions of TPP, including versions 15.1, 14.4, 14.3, 14.2, and 14.1. It also applies to earlier unsupported versions of Venafi Encryption Director, including 8 and 6.

Information on Venafi Vulnerability Severity Ratings is available here.

Recommended Action:

Customers using affected versions are strongly encouraged to upgrade to TPP 15.2 or download the appropriate patch for their currently deployed version of TPP from their Venafi FTP account.

1. Log in with your FTP credentials to https://ftp.venafi.com
2. Select Trust Protection Platform > Current (if you are running 15.2 or greater) and Previous for all others.
3. Select your appropriate patch version and download:
   1. 15.1.2
   2. 14.4.6
   3. 14.3.8
   4. 14.2.12

If your organization currently has a version deployed that is not addressed by one of the patches listed above, please contact Venafi Customer Support.

Affected Versions:

• Venafi Trust Protection Platform 15.1
• Venafi Trust Protection Platform 14.4
• Venafi Trust Protection Platform 14.3
• Venafi Trust Protection Platform 14.2
• Venafi Trust Protection Platform 14.1
• Earlier versions of Venafi Encryption Director