Security Bulletin: IBM MQ could allow an attacker to cause a denial of service caused by an error within the pubsub logic. (CVE-2020-4376)

Summary

An error within the pubsub logic could allow an attacker to execute a denial of service attack.

Vulnerability Details

CVEID:CVE-2020-4376
**DESCRIPTION:**IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service caused by an error within the pubsub logic. IBM X-Force ID: 179081.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179081 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

7.5

IBM WebSphere MQ |

7.1

Remediation/Fixes

IBM WebSphere MQ 7.1

Contact IBM Support and request a fix for APAR IT31349

IBM WebSphere MQ 7.5

Contact IBM Support and request a fix for APAR IT31349

IBM MQ 8.0

Apply Fixpack 8.0.0.15

IBM MQ 9.0. LTS

Apply Fixpack 9.0.0.10

IBM MQ 9.1 LTS

Apply Fixpack 9.1.0.5

IBM MQ 9.1 CD

Upgrade to IBM MQ 9.2

Workarounds and Mitigations

None