CVE-2022-22321

IBM MQ Appliance CVE-2022-22321 affects the 9.2 CD and 9.2 LTS releases, where local-messaging user passwords are stored using a hash that provides insufficient protection. The vulnerability can lead to exposure of sensitive data via password hashes. IBM’s remediation guidance (in IBM MQ Applianc...

CVE-2021-38986

The CVE-2021-38986 issue affects IBM MQ Appliance 9.2 CD and 9.2 LTS, where sessions are not invalidated after logout, allowing an authenticated user to impersonate another user. Root cause is insufficient session expiration. IBM/IBM X-Force assign a base CVSS around medium (5.6). Remediation: up...

Security Bulletin: IBM MQ Blockchain bridge dependencies are vulnerable to an issue in Apache Log4j (CVE-2021-45046)

Summary A Remote Code Execution issue was identified within the Log4j fix for CVE-2021-44228 that is used by Fabric Gateway to provide logging functionality. Fabric Gateway is used by the IBM MQ blockchain bridge component of IBM MQ to provide connection capability between IBM MQ queue managers a...

Security Bulletin: IBM MQ is vulnerable to multiple Jetty vulnerabilities (CVE-2021-34428, CVE-2021-34429, CVE-2021-28169)

Summary Multiple issues were identified in Eclipse Jetty that IBM MQ Explorer uses and is affected by. Vulnerability Details CVEID: CVE-2021-34428 DESCRIPTION: Eclipse Jetty could allow a physical attacker to bypass security restrictions, caused by a session ID is not invalidated flaw when an...

CVE-2021-38967

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441...

CVE-2021-38967

CVE-2021-38967 affects IBM MQ Appliance (9.2 CD and 9.2 LTS). A vulnerability allows a local privileged user to inject and execute malicious code due to a code-injection flaw. The IBM Security Bulletin references APAR IT38788 as remediation. Possible mitigations include upgrading to IBM MQ Applia...

CVE-2021-38958

CVE-2021-38958 affects IBM MQ Appliance 9.2 CD and 9.2 LTS. The issue is a denial-of-service caused by a concurrency flaw in the appliance, leading to an availability impact. The vulnerability is documented with CVSS metrics (base score 5.5 in CVSS 3.1 with LOCAL, LOW complexity, HIGH availabilit...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2021-38958)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2021-38958 DESCRIPTION: IBM MQ Appliance is affected by a denial of service attack caused by a concurrency issue. CVSS Base score: 5.1 CVSS Temporal Score: See:...

Security Bulletin: IBM MQ is vulnerable to an error within Eclipse Jetty (CVE-2020-27216)

Summary An issue was found in Eclipse Jetty that is shipped with the MQ Explorer component of IBM MQ. Vulnerability Details CVEID: CVE-2020-27216 DESCRIPTION: Eclipse Jetty could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition in the...

Security Bulletin: IBM MQ Appliance is affected by an OpenLDAP vulnerability (CVE-2020-25692)

Summary IBM MQ Appliance has resolved an OpenLDAP vulnerability. Vulnerability Details CVEID: CVE-2020-25692 DESCRIPTION: OpenLDAP is vulnerable to a denial of service, caused by a NULL pointer dereference. By sending a specially crafted TCP packet, a remote attacker could exploit this...

Security Bulletin: IBM MQ Appliance is affected by a Java SE vulnerability (CVE-2020-27221)

Summary IBM MQ Appliance has resolved a Java SE vulnerability. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. By sending an...

Security Bulletin: IBM MQ Appliance is affected by libxslt vulnerabilities (CVE-2019-11068, CVE-2019-18197)

Summary IBM MQ Appliance has resolved libxslt vulnerabilities. Vulnerability Details CVEID: CVE-2019-11068 DESCRIPTION: libxslt could allow a remote attacker to bypass security restrictions, caused by a flaw in the xsltCheckRead and xsltCheckWrite routines. By sending a specially-crafted request,...

Security Bulletin: IBM MQ Appliance is affected by multiple BIND vulnerabilities (CVE-2020-8622, CVE-2020-8623, CVE-2020-8624)

Summary IBM MQ Appliance has resolved multiple BIND vulnerabilities. Vulnerability Details CVEID: CVE-2020-8622 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an assertion failure when attempting to verify a truncated response to a TSIG-signed request. By sending a...

Security Bulletin: IBM MQ is affected by a vulnerability in json-c (CVE-2020-12762)

Summary An applicable vulnerability was found in the json-c library that is bundled with MQ server and native client installations. Vulnerability Details CVEID: CVE-2020-12762 DESCRIPTION: json-c could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow...