Security Bulletin: IBM MQ could allow an authenticated attacker with authorization to craft messages to cause a denial of service (CVE-2022-43919)

Summary

An issue was identified within the IBM MQ Server component that could allow an attacker to execute a denial of service attack due to incorrect handling of PCF messages.

Vulnerability Details

CVEID:CVE-2022-43919
**DESCRIPTION:**IBM MQ could allow an authenticated attacker with authorization to craft messages to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241354 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

The following installable MQ components are affected by the vulnerability:

- Server

If you are running any of these listed components, please apply the remediation/fixes as described below. For more information on the definitions of components used in this list see <https://www.ibm.com/support/pages/installable-component-names-used-ibm-mq-security-bulletins&gt;

Remediation/Fixes

This issue was resolved under APAR IT42674

IBM MQ 8.0

Users with an appropriate extended support entitlement should contact IBM support.

IBM MQ 9.0 LTS

Apply cumulative security update 9.0.0.17

IBM MQ 9.1 LTS

Apply FixPack 9.1.0.15

IBM MQ 9.2 LTS

Apply FixPack 9.2.0.10

IBM MQ 9.3 LTS

Apply FixPack 9.3.0.5

IBM MQ 9.1 CD, 9.2 CD and 9.3 CD

Upgrade to IBM MQ 9.3.2

Workarounds and Mitigations

None