Security Bulletin: IBM MQ Appliance is affected by a code injection vulnerability (CVE-2021-38967)

Summary

IBM MQ Appliance has resolved a code injection vulnerability.

Vulnerability Details

CVEID:CVE-2021-38967
**DESCRIPTION:**IBM MQ Appliance could allow a local privileged user to inject and execute malicious code.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/212441 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed by APAR IT38788.

IBM MQ Appliance version 9.2 LTS

Apply fixpack 9.2.0.4, or later firmware.

IBM MQ Appliance version 9.2 CD

Upgrade to 9.2.4 CD, or later firmware.

Workarounds and Mitigations

None