Security Bulletin: IBM MQ Advanced Message Security on IBM i platforms is affected by a buffer overflow issue in OpenSSL (CVE-2022-3602, CVE-2022-3786)

Summary

A buffer overflow issue was identified with OpenSSL, which IBM MQ 9.3.0 LTS on the IBM i platform uses within the Advanced Message Security feature to provide cryptographic functionality. It is not used for transport layer security (TLS) functionality for IBM MQ channel connections, which is provided by the IBM i SystemTLS libraries.

Based on current knowledge and analysis, no other IBM MQ platforms, components, versions, installable packages, or form factors are affected.

Vulnerability Details

CVEID:CVE-2022-3602
**DESCRIPTION:**OpenSSL is vulnerable to a stack-based buffer overflow, caused by improper bounds checking during X.509 certificate verification. By using a specially-crafted email address, a remote attacker could overflow a buffer and execute arbitrary code or cause the application to crash.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239161 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2022-3786
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by a stack based buffer overflow during X.509 certificate verification. By using a specially-crafted email address in a certificate, a remote attacker could exploit this vulnerability to cause a TLS client to crash, and results in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239165 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

This issue was resolved under APAR SE78814

IBM MQ 9.3 LTS

Apply iFix for APAR SE78814

Workarounds and Mitigations

Customers should ensure that only trusted and correctly formatted certificates are added into the Advanced Message Security keystore as these certificates are the only ones used for certificate validation and therefore the only ones that could trigger this vulnerability.