Security Bulletin: IBM MQ is affected by a vulnerability in libcurl (CVE-2022-32206)

Summary

An issue was identified in libcurl that affects IBM MQ. IBM MQ uses libcurl to provide HTTPURL functionality which is only used to download remote CCDT files and is not used to send or receive messages.

Vulnerability Details

CVEID:CVE-2022-32206
**DESCRIPTION:**cURL libcurl is vulnerable to a denial of service, caused by a flaw in the number of acceptable “links” in the “chained” HTTP compression algorithms. By persuading a victim to connect a specially-crafted server, a remote attacker could exploit this vulnerability to insert a virtually unlimited number of compression steps, and results in a denial of service condition.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/229740 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

This issue was resolved under APAR IT41495.

IBM MQ Version 9.0 LTS
Apply interim fix for APAR IT41495

IBM MQ Version 9.1 LTS
Apply fix pack 9.1.0.12

IBM MQ Version 9.2 LTS
Apply interim fix for APAR IT41495

IBM MQ Version 9.3 LTS
Apply fix pack 9.3.0.1

IBM MQ Version 9.1, 9.2 & 9.3 CD
Upgrade to IBM MQ 9.3.0 and apply fix pack 9.3.0.1

Workarounds and Mitigations

None