IBMA391B5F2D7EB48C0AE8F95CD0139775F3D818222ADF64CF26A92DBB2B9CA36DCSecurity Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2024-0727)
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.2 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
61.2%
Summary
IBM MQ Appliance has addressed an OpenSSL denial of service vulnerability.
Vulnerability Details
CVEID:CVE-2024-0727
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to open a specially crafted PKCS12 file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/280532 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM MQ Appliance | 9.3 LTS |
| IBM MQ Appliance | 9.3 CD |
Remediation/Fixes
This vulnerability is addressed under APAR IT45643
IBM strongly recommends addressing the vulnerability now.
IBM MQ Appliance version 9.3 LTS
Apply IBM MQ Appliance 9.3.0.17 cumulative security update, or later firmware.
IBM MQ Appliance version 9.3 CD
Apply IBM MQ Appliance 9.3.5.1 cumulative security update, or later firmware.
Workarounds and Mitigations
None
Affected configurations
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.2 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
61.2%