Security Bulletin: IBM MQ is vulnerable to a denial of service due to an error within the Queue processing function. (CVE-2020-4466)

Summary

An error within the queue processing function could allow an attacker to cause a denial of service attack.

Vulnerability Details

CVEID:CVE-2020-4466
**DESCRIPTION:**IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.0, 9.1 LTS and 9.1 CD could allow a remote authenticated attacker to cause a denial of service due to an error within the Queue processing function. IBM X-Force ID: 181563
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/181563 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM MQ WebSphere MQ 7.1

Contact IBM Support and request a fix for APAR IT28019

IBM MQ WebSphere MQ 7.5

Contact IBM Support and request a fix for APAR IT28019

IBM MQ 8.0

Apply Fixpack 8.0.0.15

IBM MQ 9.0 LTS

Apply Fixpack 9.0.0.10

IBM MQ 9.1 LTS

Apply Fixpack 9.1.0.6

IBM MQ 9.1 CD

Upgrade to IBM MQ 9.1.5

Workarounds and Mitigations

None