Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from go-toolset and amicontained

Summary

Multiple issues were identified in Red Hat UBI packages go-toolset and amicontained that were shipped with IBM MQ Operator and IBM supplied MQ Advanced container images.

Vulnerability Details

CVEID:CVE-2020-29652
**DESCRIPTION:**Golang Go is vulnerable to a denial of service, caused by a NULL pointer dereference in the golang.org/x/crypto/ssh component. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/193622 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2022-29526
**DESCRIPTION:**Golang Go could allow a remote attacker to obtain sensitive information, caused by a flaw in the Faccessat function when called with a non-zero flags parameter. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain accessible file information, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/229593 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-41721
**DESCRIPTION:**Golang Go is vulnerable to HTTP request smuggling, caused by a flaw when using MaxBytesHandler. By sending a specially-crafted HTTP(S) transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/244775 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM MQ Operator

**CD:**v2.4.0 - v2.4.2, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2, 2.3.0 - 2.3.3

LTS: v2.0.0 - 2.0.14

IBM supplied MQ Advanced container images|

CD: 9.2.0.1-r1-eus, 9.2.0.2-r1-eus, 9.2.0.2-r2-eus,
9.2.0.4-r1-eus, 9.2.0.5-r1-eus, 9.2.0.5-r2-eus, 9.2.0.5-r3-eus, 9.2.0.6-r1-eus, 9.2.0.6-r2-eus, 9.2.0.6-r3-eus, 9.2.3.0-r1, 9.2.4.0-r1, 9.2.5.0-r1, 9.2.5.0-r2, 9.2.5.0-r3, 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.1.0-r1, 9.3.1.0-r2, 9.3.1.0-r3,
9.3.1.1-r1, 9.3.2.0-r1, 9.3.2.0-r2, 9.3.2.1-r1, 9.3.2.1-r2, 9.3.3.0-r1, 9.3.3.0-r2, 9.3.3.1-r1

**
LTS: **9.2.0.1-r1-eus, 9.2.0.2-r1-eus, 9.2.0.2-r2-eus, 9.2.0.4-r1-eus, 9.2.0.5-r1-eus,
9.2.0.5-r2-eus, 9.2.0.5-r3-eus, 9.2.0.6-r1-eus, 9.2.0.6-r2-eus, 9.2.0.6-r3-eus, 9.2.3.0-r1,
9.2.4.0-r1, 9.2.5.0-r1, 9.2.5.0-r2, 9.2.5.0-r3, 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1,
9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2,
9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1

Remediation/Fixes

Issue mentioned by this security bulletin is addressed in IBM MQ Operator v2.4.3 CD release that included IBM supplied MQ Advanced 9.3.3.1-r2 container image and IBM MQ Operator v2.0.15 LTS release that included IBM supplied MQ Advanced 9.3.0.10-r2 container image. IBM strongly recommends applying the latest container images.

**IBM MQ Operator 2.4.3 CD release details:

**

Image

|

Fix Version

|

Registry

|

Image Location

—|—|—|—

ibm-mq-operator

|

v2.4.3

|

icr.io

|

icr.io/cpopen/ibm-mq-operator@sha256:dc1946d44915fa2ec52c65542af64681a496e927e8a091065218c066a3457495

ibm-mqadvanced-server

|

9.3.3.1-r2

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server@sha256:533ab523ac13003cf6495fb012a170fcbe5bb914a8cb41cb04d9292ff502ee49

ibm-mqadvanced-server-integration

|

9.3.3.1-r2

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:a8b6c4d5a60e420a0f107561abb29148f7043c1c19ed29bdc2b6154f2c7d42a3

ibm-mqadvanced-server-dev

|

9.3.3.1-r2

|

icr.io

|

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:756f2e99075c66c017640293dac4e3c2412302ca259b4b72e1d64b77aa44aae4

**IBM MQ Operator V2.0.15 LTS release details: **

Image

|

Fix Version

|

Registry

|

Image Location

—|—|—|—

ibm-mq-operator

|

2.0.15

|

icr.io

|

icr.io/cpopen/ibm-mq-operator@sha256:9f1c9142ff18b156c7d6594348c4d2a23d4020e69af5180e6b1d5021bc459a89

ibm-mqadvanced-server

|

9.3.0.10-r2

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server@sha256:a02a499cccb96faff96ddc77b06aafda47b876a23790b905a5671bf56ea081e7

ibm-mqadvanced-server-integration

|

9.3.0.10-r2

|

cp.icr.io

|

cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:788ccd28d6dc9a498d2c06420caeee5f5eacb9a777cda2a09a228d5a64152123

ibm-mqadvanced-server-dev

|

9.3.0.10-r2

|

icr.io

|

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:1ab9f6f7b64533c1984d68883292a46ed76de59dcfcd5f6d980c447067553696

Workarounds and Mitigations

None