Security Bulletin: IBM MQ Appliance is vulnerable to a denial of service attack due to an error in the Channel processing function. (CVE-2019-4762)

Summary

An error was identified in the channel processing logic that means a remote attacker could execute a denial of service attack against a queue manager.

Vulnerability Details

CVEID:CVE-2019-4762
**DESCRIPTION:**IBM MQ 9.0 and 9.1 is vulnerable to a denial of service attack due to an error in the Channel processing function. IBM X-Force ID: 173625.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173625 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM MQ and IBM MQ Appliance 9.1 LTS

Apply Fix Pack 9.1.0.3

IBM MQ and IBM MQ Appliance 9.1 CD

Upgrade to IBM MQ 9.1.5

Workarounds and Mitigations

None