Security Bulletin: IBM MQ is vulnerable to an issue within IBM® Runtime Environment Java™ Technology Edition (CVE-2020-27221)

Summary

An issue was identified in the IBM® Runtime Environment Java™ Technology Edition shipped with IBM MQ.

Vulnerability Details

CVEID:CVE-2020-27221
**DESCRIPTION:**Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/195353 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

This issue has been addressed under the following APARs:

• Version 8 - IT35343
• Version 9.0 - IT35811
• Version 9.1 - IT35811
• Version 9.2 - IT35540

IBMMQ 8

Apply Fix Pack 8.0.0.16

IBM MQ 9.0

Appy interim fix for APAR IT35811

IBM MQ 9.1

Apply interim fix for APAR IT35811

IBM MQ 9.2 LTS

Apply Fix Pack 9.2.0.2

IBM MQ 9.1 CD & 9.2 CD

Upgrade to IBM MQ 9.2.2

Workarounds and Mitigations

None