9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.009 Low
EPSS
Percentile
82.6%
Multiple issues were identified in Red Hat UBI(ubi8/ubi-minimal) v8.5-x packages that were shipped with IBM MQ Operator and IBM supplied MQ Advanced container images. We have also identified an issue in the IBM WebSphere Application Server Liberty component that is packaged with IBM supplied MQ Advanced container images.
CVEID:CVE-2021-3521
**DESCRIPTION:**RPM Project RPM could allow a remote attacker to bypass security restrictions, caused by improper validation the binding signature of subkeys prior to importing them. By persuading a victim to add a specially-crafted subkey to a legitimate public key, an attacker could exploit this vulnerability cause the victim to trust a malicious signature.
CVSS Base score: 4.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213411 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)
CVEID:CVE-2021-3999
**DESCRIPTION:**GNU glibc is vulnerable to an off-by-one buffer overflow and underflow, caused by improper bounds checking by the getcwd() function. By sending a specially-crafted request, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217981 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID:CVE-2021-39031
**DESCRIPTION:**IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 213875.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213875 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID:CVE-2022-23219
**DESCRIPTION:**GNU C Library (aka glibc) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the clnt_create function in the sunrpc module. By sending a specially-crafted hostname argument, a local attacker could overflow a buffer and execute arbitrary code or cause a denial of service on the system.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217303 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID:CVE-2022-23218
**DESCRIPTION:**GNU C Library (aka glibc) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the svcunix_create function in the sunrpc module. By sending a specially-crafted path argument, a local attacker could overflow a buffer and execute arbitrary code or cause a denial of service on the system.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217302 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM MQ Operator CD Release | v1.7.0 |
IBM MQ Operator EUS Release | v1.3.2 |
IBM MQ Advanced Server Container image | v9.2.4.0-r1,9.2.0.4-r1-eus |
Issues listed by this security bulletin are addressed in IBM MQ Operator v1.8.0 CD release that included IBM supplied MQ Advanced v9.2.5.0 container images and IBM MQ Operator v1.3.3 EUS release that included IBM supplied MQ Advanced v9.2.0.5 container images.
IBM MQ Operator v1.8.0 CD release details:
Image | Fix Version | Registry | Image Location |
---|---|---|---|
ibm-mq-operator | v1.8.0 | icr.io | icr.io/cpopen/ibm-mq-operator@sha256:e53a119acde5773bd052257e2a6bb9780b954fb2a33c6879328a19b333abaf3e |
ibm-mqadvanced-server | 9.2.5.0-r1 | cp.icr.io | cp.icr.io/cp/ibm-mqadvanced-server@sha256:f12bfa6088ae7af3bcbf4377cd41818ab9160d90b232ed2d952327dea1b70e21 |
ibm-mqadvanced-server-integration | 9.2.5.0-r1 | cp.icr.io | cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:97d8d002ff34cd2a6d07f81f9104a3b8eb6eda6626e646e32b47f0fd108c6ad1 |
ibm-mqadvanced-server-dev | 9.2.5.0-r1 | icr.io | icr.io/ibm-messaging/mq@sha256:8236529768dfe9ab29f5a91a20a7b4b1f9dde1b54f21ff926769fb3e929d0bcc |
IBM MQ Operator v1.3.3 EUS release details:
Image | Fix Version | Registry | Image Location |
---|---|---|---|
ibm-mq-operator | v1.3.3 | icr.io | icr.io/cpopen/ibm-mq-operator@sha256:ecacd486bd170ad5ac3494ef3853670cb911cfbac676e175ba8b54b72e12a340 |
ibm-mqadvanced-server-integration | 9.2.0.5-r1-eus | cp.icr.io | cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:7902ec5de627a7c6ea09d14ca9a672435bec9923a3d28e5c097cbe8385ba39a6 |
For remediation, upgrading your current IBM MQ Operator and Queue managers to corresponding versions mentioned above will fix the vulnerabilities.
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm mq certified container software | eq | 1.7.0 |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.009 Low
EPSS
Percentile
82.6%