Security Bulletin: IBM MQ Appliance is affected by a data corruption vulnerability (CVE-2020-4592)

Summary

IBM MQ Appliance has addressed a data corruption vulnerability.

Vulnerability Details

CVEID:CVE-2020-4592
**DESCRIPTION:**IBM MQ could allow an authenticated user, under nondefault configuration to cause a data corruption attack due to an error when using segmented messages.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/184755 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

IBM MQ Appliance 9.1 LTS

Apply fixpack 9.1.0.6, or later maintenance

IBM MQ Appliance 9.1 CD

Upgrade to 9.2.0, or later maintenance*

• The latest available Continuous Delivery (CD) firmware level at the time of publishing is 9.2.0. As this firmware level is also an LTS level, it is valid to apply the 9.2.0.1 LTS fix pack and then update to a subsequent CD release (ie. 9.2.1 CD) once available. Please refer to the IBM MQ FAQ for Long Term Support and Continuous Delivery releases for additional information on LTS and CD releases.

Workarounds and Mitigations

None