Security Bulletin: IBM MQ is affected by a vulnerability within cURL libcurl (CVE-2019-15601)

2020-04-1510:24:14

www.ibm.com

JSON

Summary

An issue was identified within the libcurl library supplied by IBM MQ which is used for CCDT URL functionality.

Vulnerability Details

CVEID:CVE-2019-15601
**DESCRIPTION:**cURL libcurl could allow a remote attacker to bypass security restrictions, caused by improper input validation. By creating a FILE: URL, an attacker could exploit this vulnerability to gain access to a remote file using SMB.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/174079 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM MQ	9.1 LTS
IBM MQ	9.0 LTS
IBM MQ	9.1 CD

Remediation/Fixes

IBM MQ 9.0 LTS

Apply Fix Pack 9.0.0.9

IBM MQ 9.1 LTS

Apply Fix Pack 9.1.0.5

IBM MQ 9.1 CD

Upgrade to IBM MQ 9.1.5

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm mqeq9.0.0.0
ibm mqeq9.0.0.1
ibm mqeq9.0.0.2
ibm mqeq9.0.0.3
ibm mqeq9.0.0.4
ibm mqeq9.0.0.5
ibm mqeq9.0.0.6
ibm mqeq9.0.0.7
ibm mqeq9.0.0.8
ibm mqeq9.1.0.0

Name	Operator	Version
ibm mq	eq	9.0.0.0
ibm mq	eq	9.0.0.1
ibm mq	eq	9.0.0.2
ibm mq	eq	9.0.0.3
ibm mq	eq	9.0.0.4
ibm mq	eq	9.0.0.5
ibm mq	eq	9.0.0.6
ibm mq	eq	9.0.0.7
ibm mq	eq	9.0.0.8
ibm mq	eq	9.1.0.0