Lucene search

K
ibmIBM551EA8A24F834AC5B54D10C68A8308B7F65017542B991248D58588B2D9AB020B
HistoryDec 17, 2021 - 1:33 p.m.

Security Bulletin: IBM MQ is vulnerable to multiple issues with libcurl (CVE-2021-22946, CVE-2021-22947)

2021-12-1713:33:37
www.ibm.com
17

0.003 Low

EPSS

Percentile

69.8%

Summary

Multiple issues were identified with a version of libcurl which is shipped with IBM MQ. libcurl is used by IBM MQ to provide CCDTURL functionality.

Vulnerability Details

CVEID:CVE-2021-22946
**DESCRIPTION:**cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a required TLS bypassed issue. By sniffing the network, an attacker could exploit this vulnerability to obtain sensitive data in clear text over the network, and use this information to launch further attacks against the affected system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/209452 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-22947
**DESCRIPTION:**cURL libcurl is vulnerable to a man-in-the-middle attack, caused by a flaw when connecting to an IMAP, POP3, SMTP or FTP server to exchange data securely using STARTTLS to upgrade the connection to TLS level. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/209453 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM MQ 9.1 LTS
IBM MQ 9.0 LTS
IBM MQ 9.2 CD
IBM MQ 9.1 CD
IBM MQ 9.2 LTS

Remediation/Fixes

This issue was resolved under APAR IT38413

IBM MQ 9.0 LTS

Apply FixPack 9.0.0.12

IBM MQ 9.1 LTS

Apply FixPack 9.1.0.10

IBM MQ 9.2 LTS

Apply FixPack 9.2.0.4

IBM MQ 9.1 CD and 9.2 CD

Upgrade to IBM MQ 9.2.4

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm mqeq9.0.0
ibm mqeq9.1.0
ibm mqeq9.2.0