Security Bulletin: IBM MQ Appliance is vulnerable to exposure of sensitive information (CVE-2023-5981 and CVE-2024-0533)

Summary

IBM MQ Appliance has addressed GNU GnuTLS exposure of sensitive information vulnerabilities.

Vulnerability Details

CVEID:CVE-2023-5981
**DESCRIPTION:**GNU GnuTLS could allow a remote attacker to obtain sensitive information, caused by a timing sidechannel issue during RSA-PSK key exchange. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/271914 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2024-0553
**DESCRIPTION:**GnuTLS could allow a remote attacker to obtain sensitive information. By perform a timing side-channel attack in the RSA-PSK key exchange, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279606 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under APAR IT46613

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.3 LTS

Apply IBM MQ Appliance fix pack 9.3.0.21, or later firmware.

IBM MQ Appliance version 9.3 CD

Upgrade to IBM MQ Appliance fix pack 9.4.0.5, or later firmware.

IBM MQ Appliance version 9.4 LTS

Apply IBM MQ Appliance fix pack 9.4.0.5, or later firmware.

Workarounds and Mitigations

Only applicable to IBM MQ Appliances configured in a High Availability group.