Security Bulletin: IBM MQ Passwords specified by MQ java or JMS applications can appear in WebSphere Application Server trace. (CVE-2017-1284)

Summary Passwords specified by MQ java or JMS applications can appear in WebSphere Application Server trace when establishing CLIENT transport mode connections. Vulnerability Details CVEID: CVE-2017-1284 DESCRIPTION: IBM MQ could allow a local user with ability to run or enable trace, to obtain...

CVE-2017-1284

IBM MQ (WebSphere MQ) versions affected: 8.x up to 8.0.0.6; 9.0.0.0–9.0.0.1; and 9.0.1–9.0.2 (CD). A local user able to enable/trace may obtain sensitive data from WebSphere Application Server traces, including credentials, via CLIENT transport mode traces. Root cause: traces disclose credentials...