Lucene search

K
ibmIBM02FD66C703F4EAC4F1C42D44C3104CB6FCB301528244A0B5FB8C09F539919B5C
HistoryMay 22, 2024 - 9:19 a.m.

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to glibc, Golang Go , Apache HTTP, IBM GSKit-Crypto and GnuTLS packages/liberaries .

2024-05-2209:19:09
www.ibm.com
9
ibm mq operator
queue manager
glibc vulnerability
golang go vulnerability
apache http vulnerability
ibm gskit-crypto vulnerability
gnutls vulnerability
cve-2024-33599
cve-2023-45288
cve-2024-27316
cve-2024-33601
cve-2024-2961

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

9.1 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.5%

Summary

IBM MQ Operator and Queue manager container images are vulnerable to glibc, Golang Go , Apache HTTP, IBM GSKit-Crypto and GnuTLS. This bulletin identifies the steps required to address these vulnerabilities.

Vulnerability Details

CVEID:CVE-2024-33599
**DESCRIPTION:**glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when the Name Service Cache Daemon’s (nscd) fixed size cache is exhausted by client requests. By sending a subsequent client request, a remote attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 7.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/290172 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)

CVEID:CVE-2023-45288
**DESCRIPTION:**Golang Go is vulnerable to a denial of service, caused by a memory exhaustion flaw due to flood of CONTINUATION frames in the HTTP/2 protocol stack in the net/http and x/net/http2 packages. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/286962 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2024-27316
**DESCRIPTION:**Apache HTTP Server is vulnerable to a denial of service, caused by the failure to check or limit the use of HTTP/2 CONTINUATION frames that can be sent within a single stream. By sending a stream of CONTINUATION frames that will not be appended to the header list in memory but will still be processed and decoded by the server or will be appended to the header list, a remote attacker could exploit this vulnerability to cause an out of memory (OOM) crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/286950 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2024-33601
**DESCRIPTION:**glibc is vulnerable to a denial of service, caused by a memory allocation failure when the Name Service Cache Daemon’s (nscd) netgroup cache uses the xmalloc or xrealloc functions. A local attacker could exploit this vulnerability to terminate the daemon.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/290170 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2024-2961
**DESCRIPTION:**GNU C Library is vulnerable to a denial of service, caused by an out-of-bounds write flaw in the iconv() function when converting strings to the ISO-2022-CN-EXT character set. By persuading a victim to open a specially crafted content, a remote attacker could exploit this vulnerability to cause the application to crash or overwrite a neighbouring variable.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/287843 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)

CVEID:CVE-2024-28834
**DESCRIPTION:**GnuTLS could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the ECDSA code. By utilize Minerva attack techniques, an attacker could exploit this vulnerability to obtain private key information, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/286142 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2024-33602
**DESCRIPTION:**glibc is vulnerable to a denial of service, caused by a memory corruption by the Name Service Cache Daemon’s (nscd) netgroup cache when the NSS callback fails to store all strings in the provided buffer. A local attacker could exploit this vulnerability to corrupt memory and cause a denial of service.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/290169 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2024-33600
**DESCRIPTION:**glibc is vulnerable to a denial of service, caused by a NULL pointer dereference when the Name Service Cache Daemon’s (nscd) cache fails to add a not-found netgroup response to the cache. A remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/290171 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM MQ Operator

**CD:**v3.0.0, v3.0.1, v3.1.0, 3.1.1, 3.1.2

LTS: v2.0.0 - 2.0.21

**Other Release:**v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2

IBM supplied MQ Advanced container images|

**C****D:**9.3.4.0-r1, 9.3.4.1-r1,9.3.5.0-r1,9.3.5.0-r2,9.3.5.1-r1

**LTS:**9.2.0.1-r1-eus, 9.2.0.2-r1-eus, 9.2.0.2-r2-eus, 9.2.0.4-r1-eus, 9.2.0.5-r1-eus,
9.2.0.5-r2-eus, 9.2.0.5-r3-eus, 9.2.0.6-r1-eus, 9.2.0.6-r2-eus, 9.2.0.6-r3-eus, 9.2.3.0-r1,
9.2.4.0-r1, 9.2.5.0-r1, 9.2.5.0-r2, 9.2.5.0-r3, 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1,
9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2,
9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1

**
Other Release: **9.2.0.1-r1-eus, 9.2.0.2-r1-eus, 9.2.0.2-r2-eus, 9.2.0.4-r1-eus, 9.2.0.5-r1-eus, 9.2.0.5-r2-eus, 9.2.0.5-r3-eus, 9.2.0.6-r1-eus, 9.2.0.6-r2-eus, 9.2.0.6-r3-eus, 9.2.3.0-r1, 9.2.4.0-r1, 9.2.5.0-r1, 9.2.5.0-r2, 9.2.5.0-r3, 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.1.0-r1, 9.3.1.0-r2, 9.3.1.0-r3, 9.3.1.1-r1, 9.3.2.0-r1, 9.3.2.0-r2, 9.3.2.1-r1, 9.3.2.1-r2, 9.3.3.0-r1, 9.3.3.0-r2, 9.3.3.1-r1, 9.3.3.1-r2, 9.3.3.2-r1, 9.3.3.2-r2, 9.3.3.2-r3, ,9.3.3.3-r1, 9.3.3.3-r2

Remediation/Fixes

Issues mentioned by this security bulletin are addressed in -

  • IBM MQ Operator v3.1.3 CD release that included IBM supplied MQ Advanced 9.3.5.1-r2 container image
  • IBM MQ Operator v2.0.22 LTS release that included IBM supplied MQ Advanced 9.3.0.17-r2 container image

IBM strongly recommends applying the latest container images

**IBM MQ Operator 3.1.3 CD release details:

**

Image

|

Fix Version

|

Registry

|

Image Location

—|—|—|—

ibm-mq-operator

|

v3.1.3

|

icr.io

|

icr.io/cpopen/ibm-mq-operator@sha256:510a63020762d4185fc3ef0fe413e0da0587e34dcac7f3a0d94d9f462cf41851

ibm-mqadvanced-server

|

9.3.5.1-r2

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server@sha256:d71105c543132f072904a9db3e2a4d07cc73426ea86424878d5039884879bc32

ibm-mqadvanced-server-integration

|

9.3.5.1-r2

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-serv-integration@sha256:93e9e0e22018de3e5522805e239556ac35d1f50bc76ae2bc2755f6f70633b161

ibm-mqadvanced-server-dev

|

9.3.5.1-r2

|

icr.io

|

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:70b2028551de81a16eb250b30eec6b1cb4064309c68ebec3d6851e806c3459e6


IBM MQ Operator V2.0.22 LTS release details:

Image

|

Fix Version

|

Registry

|

Image Location

—|—|—|—

ibm-mq-operator

|

v2.0.22

|

icr.io

|

icr.io/cpopen/ibm-mq-operator@sha256:6c98e84ae84dac76b2687ad0d24cfb26853f97b67db47567b402b4f270b183f7

ibm-mqadvanced-server

|

9.3.0.17-r2

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server@sha256:28fc7dc34a5d525b58ad724cb66e7b8c83b529be12cc4f5f994d51b168d851c6

ibm-mqadvanced-server-integration

|

9.3.0.17-r2

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:fb36ac152003ce45d525adc97986faa9e11e2336c859adaa41ead451282f0edb

ibm-mqadvanced-server-dev

|

9.3.0.17-r2

|

icr.io

|

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:d0d88a8dae3cdcc95943ea8c4c1af627fa86cd9751d1cb0afed3022138318756


Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmmq_certified_containerMatch3.1.3
OR
ibmmq_certified_containerMatch2.0.22

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

9.1 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.5%