Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to libssh, Linux-pam ,Kerberos 5, systemd and idna packages/liberaries.

Summary

IBM MQ Operator and Queue manager container images are vulnerable to libssh, Linux-pam ,Kerberos 5, systemd and idna. This bulletin identifies the steps required to address these vulnerabilities

Vulnerability Details

CVEID:CVE-2023-6004
**DESCRIPTION:**libssh could allow a local authenticated attacker to execute arbitrary commands on the system, caused by a flaw in the ProxyCommand handling. By sending a specially crafted request using hostname in expanded proxycommand, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base score: 3.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/275743 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

CVEID:CVE-2023-6918
**DESCRIPTION:**libssh is vulnerable to a denial of service, caused by an unchecked return value flaw for the abstract layer for message digest (MD) operations. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/275423 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2024-27256
**DESCRIPTION:**IBM MQ Container uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/283906 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2024-22365
**DESCRIPTION:**Linux-pam is vulnerable to a denial of service, caused by a flaw in pam_namespace.so. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279864 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2024-26458
**DESCRIPTION:**Kerberos 5 is vulnerable to a denial of service, caused by a memory leak in /krb5/src/lib/rpc/pmap_rmt.c. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/284479 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-7008
**DESCRIPTION:**systemd is vulnerable to a man-in-the-middle attack, caused by a flaw with able to accept records of DNSSEC-signed domains even when they have no signature. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to manipulate records.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/280246 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVEID:CVE-2024-3651
**DESCRIPTION:**idna could allow a local user to cause a denial of service using a specially crafted argument to the idna.encode() function and consume system resources.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/289330 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM MQ Operator

**CD:**v3.0.0, v3.0.1, v3.1.0 - 3.1.3

LTS: v2.0.0 - 2.0.22

**Other Release:**v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2

IBM supplied MQ Advanced container images|

**C****D:**9.3.4.0-r1, 9.3.4.1-r1,9.3.5.0-r1,9.3.5.0-r2,9.3.5.1-r1, 9.3.5.1-r2

**LTS:**9.2.0.1-r1-eus, 9.2.0.2-r1-eus, 9.2.0.2-r2-eus, 9.2.0.4-r1-eus, 9.2.0.5-r1-eus,
9.2.0.5-r2-eus, 9.2.0.5-r3-eus, 9.2.0.6-r1-eus, 9.2.0.6-r2-eus, 9.2.0.6-r3-eus, 9.2.3.0-r1,
9.2.4.0-r1, 9.2.5.0-r1, 9.2.5.0-r2, 9.2.5.0-r3, 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1,
9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2,
9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2

**
Other Release: **9.2.0.1-r1-eus, 9.2.0.2-r1-eus, 9.2.0.2-r2-eus, 9.2.0.4-r1-eus, 9.2.0.5-r1-eus, 9.2.0.5-r2-eus, 9.2.0.5-r3-eus, 9.2.0.6-r1-eus, 9.2.0.6-r2-eus, 9.2.0.6-r3-eus, 9.2.3.0-r1, 9.2.4.0-r1, 9.2.5.0-r1, 9.2.5.0-r2, 9.2.5.0-r3, 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.1.0-r1, 9.3.1.0-r2, 9.3.1.0-r3, 9.3.1.1-r1, 9.3.2.0-r1, 9.3.2.0-r2, 9.3.2.1-r1, 9.3.2.1-r2, 9.3.3.0-r1, 9.3.3.0-r2, 9.3.3.1-r1, 9.3.3.1-r2, 9.3.3.2-r1, 9.3.3.2-r2, 9.3.3.2-r3, ,9.3.3.3-r1, 9.3.3.3-r2

Remediation/Fixes

Issues mentioned by this security bulletin are addressed in -

• IBM MQ Operator v3.2.0 CD and SC2 (formerly LTS) release that included IBM supplied MQ Advanced 9.4.0.0-r1 container image
• IBM MQ Operator v2.0.23 LTS release that included IBM supplied MQ Advanced 9.3.0.17-r3 container image

IBM strongly recommends applying the latest container images

**IBM MQ Operator v3.2.0 CD and SC2 (formerly LTS) release details:

**

Image

|

Fix Version

|

Registry

|

Image Location

—|—|—|—

ibm-mq-operator

|

v3.2.0

|

icr.io

|

icr.io/cpopen/ibm-mq-operator@sha256:959d717c1a70bb9fbfa0ccee23975e8642dd9c4d447335200b33048e91731fba

ibm-mqadvanced-server

|

9.4.0.0-r1

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server@sha256:e452c666deb61641ff08a12d48060af21fa7317d5b1a5c54228f0ed97595e209

ibm-mqadvanced-server-integration

|

9.4.0.0-r1

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-serv-integration@sha256:15954770240350b4babff5a7480bd219995bd19dde41307a20444255936b71d7

ibm-mqadvanced-server-dev

|

9.4.0.0-r1

|

icr.io

|

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:cdebb5b8ae79b4b6d62b97c532a2907745e63510ea190a00e223f9701b52108c

IBM MQ Operator V2.0.23 LTS release details:

Image

|

Fix Version

|

Registry

|

Image Location

—|—|—|—

ibm-mq-operator

|

v2.0.23

|

icr.io

|

icr.io/cpopen/ibm-mq-operator@sha256:76fcd8ae0852450af8b6cb9402b9b307723cbb693daec4572dcb3b3660380426

ibm-mqadvanced-server

|

9.3.0.17-r3

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server@sha256:c815c9ec233a8b7b8276fcebb70a23ce9855ae4c87133c083e4565158fe8aa1f

ibm-mqadvanced-server-integration

|

9.3.0.17-r3

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:435284f8f377889ceff460ecb2865b7103ac1dcc4cb622db2aca55789d598e38

ibm-mqadvanced-server-dev

|

9.3.0.17-r3

|

icr.io

|

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:2140886bdd174e71f45adf5fe078629219a4c11fa015b303596dbd9de9d96b49

**

**

Workarounds and Mitigations

None