Security Bulletin: IBM MQ Appliance is affected by a zlib vulnerability (CVE-2018-25032)

Summary

IBM MQ Appliance has resolved a zlib vulnerability.

Vulnerability Details

CVEID:CVE-2018-25032
**DESCRIPTION:**Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By using many distant matches, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222615 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under IT40353

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.2 LTS

Apply 9.2.0.6 fixpack, or later firmware.

IBM MQ Appliance version 9.2 CD

Upgrade to 9.2.5 CD CSU01, or later firmware.

Workarounds and Mitigations

None