SA40384 - November 11, 2016 OpenSSL Security Advisory

On November 11, 2016 the OpenSSL project announced a group of new security vulnerabilities. Pulse Secure evaluates all current supported versions of Pulse Secure products. For a list of currently supported software versions, please refer to our EOL policy.

The OpenSSL advisory can be found at the following link: https://www.openssl.org/news/changelog.html.

All supported Pulse Secure products were evaluated and found not vulnerable to the following CVE's:

• ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)
• CMS Null dereference (CVE-2016-7053)
• Montgomery multiplication may produce incorrect results (CVE-2016-7055)

Products confirmed not vulnerable:

• Pulse Connect Secure
• Pulse Policy Secure
• Pulse Mobile (iOS and Android)
• Pulse Secure Desktop (Windows & macOS)
• Pulse Linux / Network Connect (Linux)
• Odyssey Access Client
• Pulse One
• Network Connect (Windows & macOS)
• Network Connect (FIPS)
• Host Checker
• Pulse In-box plugin
• SBR