Security Bulletin: IBM MQ is affected by multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8

Summary

Multiple vulnerabilities were found with IBM® Runtime Environment Java™ Technology Edition, Version 8 which is shipped with IBM MQ (CVE-2022-21624, CVE-2022-21626)

Vulnerability Details

CVEID:CVE-2022-21626
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238689 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2022-21624
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to update, insert or delete data resulting in a low integrity impact using unknown attack vectors.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238699 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

The following installable MQ components are affected by the vulnerability:

• Java JRE

• IBM MQ Explorer

• Managed File Transfer

• MQ IPT

If you are running any of these listed components, please apply the remediation/fixes as described below. For more information on the definitions of components used in this list see <https://www.ibm.com/support/pages/installable-component-names-used-ibm-mq-security-bulletins&gt;

Remediation/Fixes

These issues were resolved under APAR IT42457 and APAR IT43613

IBM MQ version 9.0 LTS for Windows, Linux, AIX, Solaris

Apply CSU 9.0.0.14

IBM MQ version 9.0 LTS for HP

Apply CSU 9.0.0.17

IBM MQ version 9.1 LTS

Apply CSU 9.1.0.13

IBM MQ version 9.2 LTS

Apply FixPack 9.2.0.7

IBM MQ version 9.3 LTS

Apply FixPack 9.3.0.2

IBM MQ version 9.1, 9.2 & 9.3 CD

Upgrade to IBM MQ 9.3.0 and apply CSU 9.3.1.1

Workarounds and Mitigations

None