Security Bulletin: IBM MQ Appliance is affected by a sensitive information disclosure vulnerability (CVE-2021-38999)

Summary

IBM MQ Appliance has resolved a sensitive information disclosure vulnerability.

Vulnerability Details

CVEID:CVE-2021-38999
**DESCRIPTION:**IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace.
CVSS Base score: 5.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213214 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under APAR IT38978.

IBM MQ Appliance version 9.2 LTS

Apply fixpack 9.2.0.4, or later firmware.

IBM MQ Appliance version 9.2 CD

Upgrade to 9.2.4 CD, or later firmware.

Workarounds and Mitigations

None