CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
95.5%
Multiple issues were identified in Red Hat UBI(ubi8/ubi-minimal) v8.6-x packages: openssl, pcre2 and Golang Go, that were shipped with IBM MQ Operator and IBM supplied MQ Advanced container images.
CVEID:CVE-2022-1962
**DESCRIPTION:*Golang Go is vulnerable to a denial of service, caused by a stack exhaustion flaw in all Parse functions. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a panic, and results in a denial of service condition.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/232543 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2022-2068
**DESCRIPTION:**OpenSSL could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the c_rehash script. By sending a specially-crafted request using shell metacharacters, an attacker could exploit this vulnerability to execute arbitrary commands with the privileges of the script on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/226018 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVEID:CVE-2022-1586
**DESCRIPTION:**PCRE2 could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds read in the compile_xclass_matchingpath() function in the pcre2_jit_compile.c file. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/226863 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVEID:CVE-2022-2097
**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by improper encryption of data by the AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230425 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID:CVE-2022-1292
**DESCRIPTION:**OpenSSL could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the c_rehash script. By sending a specially-crafted request using shell metacharacters, an attacker could exploit this vulnerability to execute arbitrary commands with the privileges of the script on the system.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225619 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Affected Product(s) | Version(s) |
---|---|
IBM MQ Operator | EUS release 1.3.6 and LTS Release 2.0.1 |
IBM supplied MQ Advanced container images | v9.2.0.6-r1 and v9.3.0.0-r2 |
Issues listed by this security bulletin are addressed in IBM MQ Operator 2.0.2 LTS release that included IBM supplied MQ Advanced 9.3.0.0 container images and IBM MQ Operator 1.3.7 EUS release that included IBM supplied MQ Advanced 9.2.0.6 container images.
IBM MQ Operator 2.0.2 LTS release details:
Image | Fix Version | Registry | Image Location |
---|---|---|---|
ibm-mq-operator | 2.0.2 | icr.io | icr.io/cpopen/ibm-mq-operator@sha256:25e6a931256553b5a22c6cdc7b75618919918a5b3cc4ebf3552011e2f1cbd2d7 |
ibm-mqadvanced-server | 9.3.0.0-r3 | cp.icr.io | cp.icr.io/cp/ibm-mqadvanced-server@sha256:b84a3bdcbbc480d6d4268a9e662a5a30cc2fd3dc45100e7591edd330f8edf80d |
ibm-mqadvanced-server-integration | 9.3.0.0-r3 | cp.icr.io | cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:77ed05f946e9af9be08d29f8bcaced16c636c69fe7e7f9f517e7fb048c683d98 |
ibm-mqadvanced-server-dev | 9.3.0.0-r3 | icr.io | icr.io/ibm-messaging/mq@sha256:cc5c5c7deba44f295723b670c6834ee64babc0b47b6e9df5c267390a0c5fc3ce |
IBM MQ Operator 1.3.7 EUS release details:
Image | Fix Version | Registry | Image Location |
---|---|---|---|
ibm-mq-operator | 1.3.7 | icr.io | icr.io/cpopen/ibm-mq-operator@sha256:a9de15036892531832006c0ae0e6740f0533af54e1b8fa52170dd2ed0b5349b7 |
ibm-mqadvanced-server-integration | 9.2.0.6-r2-eus | cp.icr.io | cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:c1e5ee8b0d36e88a2e9f59dcc24923440a0eb33b60b0a71907fe4f0338acdfef |
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | ibm_mq_certified_container_software | 2.0.1 | cpe:2.3:a:ibm:ibm_mq_certified_container_software:2.0.1:*:*:*:*:*:*:* |
ibm | ibm_mq_certified_container_software | 1.3.6 | cpe:2.3:a:ibm:ibm_mq_certified_container_software:1.3.6:*:*:*:*:*:*:* |
ibm | ibm_mq_certified_container_software | 9.3.0.0 | cpe:2.3:a:ibm:ibm_mq_certified_container_software:9.3.0.0:*:*:*:*:*:*:* |
ibm | ibm_mq_certified_container_software | 2 | cpe:2.3:a:ibm:ibm_mq_certified_container_software:2:*:*:*:*:*:*:* |
ibm | ibm_mq_certified_container_software | 9.2.0.6 | cpe:2.3:a:ibm:ibm_mq_certified_container_software:9.2.0.6:*:*:*:*:*:*:* |
ibm | ibm_mq_certified_container_software | 1 | cpe:2.3:a:ibm:ibm_mq_certified_container_software:1:*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
95.5%