Security Bulletin: IBM MQ Operator and Queue Manager container images are vulnerable to vulnerabilities from libksba and sqlite (CVE-2022-47629 and CVE-2022-35737)

Summary

Issues were identified in Red Hat UBI packages libksba and sqlite that were shipped with IBM MQ Operator and IBM supplied MQ Advanced container images.

Vulnerability Details

CVEID:CVE-2022-47629
**DESCRIPTION:**Libksba could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the CRL signature parser. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/242850 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2022-35737
**DESCRIPTION:**SQLite is vulnerable to a denial of service, caused by an array-bounds overflow. By sending C API with specially-crafted string argument, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/232832 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Issues listed by this security bulletin are addressed in IBM MQ Operator 2.3.0 CD release that included IBM supplied MQ Advanced 9.3.2.0-r1 container images and IBM MQ Operator 2.0.8 LTS release that included IBM supplied MQ Advanced 9.3.0.4-r1 container images.

IBM MQ Operator 2.3.0 CD release details:

IBM MQ Operator 2.0.8 LTS release details:

Workarounds and Mitigations

None