Security Bulletin: IBM MQ Appliance affected by an OpenSSL vulnerability (CVE-2022-0778)

Summary

IBM MQ Appliance has resolved an OpenSSL vulnerability.

Vulnerability Details

CVEID:CVE-2022-0778
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by a flaw in the BN_mod_sqrt() function when parsing certificates. By using a specially-crafted certificate with invalid explicit curve parameters, a remote attacker could exploit this vulnerability to cause an infinite loop, and results in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221911 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under IT40353

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.2 LTS

Apply 9.2.0.6 fixpack, or later firmware.

IBM MQ Appliance version 9.2 CD

Upgrade to 9.2.5 CD CSU01, or later firmware.

Workarounds and Mitigations

None