CVE-2016-6304 Arista EOS and CloudVision eXchange Multiple OpenSSL Vulnerabilities (Security Advisory 0024)

Arista has released updates for EOS and CloudVision eXchange which addresses multiple OpenSSL vulnerabilities affecting the products.

Successful exploitation of the vulnerabilities may cause a denial of service (CVE-2016-6304), potentially decrypt SSL data when 3DES cipher is used (CVE-2016-2183) and recover SSH DSA private keys (CVE-2016-2178)

Customers are advised to update EOS version 4.17.2F to fix the vulnerabilites for both EOS and CloudVision eXchange

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Security Advisory 0024: Arista