Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

1) Deserialization of Untrusted Data

EUVDB-ID: #VU64275

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-28948

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insecure input validation when processing serialized data in the Unmarshal function. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ Operator: before 2.0.18

IBM supplied MQ Advanced container images: before 9.3.0.15-r1

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_mq_operator:*:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_supplied_mq_advanced_container_images:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7112467

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource management error

EUVDB-ID: #VU78463

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-3446

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the DH_check(), DH_check_ex() and EVP_PKEY_param_check() function when processing a DH key or DH parameters. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ Operator: before 2.0.18

IBM supplied MQ Advanced container images: before 9.3.0.15-r1

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_mq_operator:*:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_supplied_mq_advanced_container_images:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7112467

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU78798

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-3817

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when checking the long DH keys. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ Operator: before 2.0.18

IBM supplied MQ Advanced container images: before 9.3.0.15-r1

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_mq_operator:*:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_supplied_mq_advanced_container_images:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7112467

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information Exposure Through Timing Discrepancy

EUVDB-ID: #VU83316

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-5981

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform timing attack.

The vulnerability exists due to the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. A remote attacker can perform timing sidechannel attack in RSA-PSK key exchange.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ Operator: before 2.0.18

IBM supplied MQ Advanced container images: before 9.3.0.15-r1

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_mq_operator:*:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_supplied_mq_advanced_container_images:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7112467

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU82978

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-45803

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to urllib3 does not remove the HTTP request body when redirecting HTTP response using status codes 301, 302, or 303, after the request had its method changed from one that could accept a request body (e.g. from POST to GET). A remote attacker can gain access to potentially sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ Operator: before 2.0.18

IBM supplied MQ Advanced container images: before 9.3.0.15-r1

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_mq_operator:*:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_supplied_mq_advanced_container_images:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7112467

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU83546

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-45142

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect processing of HTTP header User-Agent and HTTP method. A remote attacker can send multiple requests with long randomly generated HTTP methods or/and User agents and consume memory resources, leading to a denial of service condition.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ Operator: before 2.0.18

IBM supplied MQ Advanced container images: before 9.3.0.15-r1

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_mq_operator:*:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_supplied_mq_advanced_container_images:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7112467

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU81964

Risk: Medium

CVSSv4.0: 4.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-39323

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when processing line directives (e.g. "//line") in the code. A remote attacker can bypass restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build".

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ Operator: before 2.0.18

IBM supplied MQ Advanced container images: before 9.3.0.15-r1

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_mq_operator:*:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_supplied_mq_advanced_container_images:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7112467

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource management error

EUVDB-ID: #VU82894

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-5678

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within DH_generate_key() and DH_check_pub_key() functions. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ Operator: before 2.0.18

IBM supplied MQ Advanced container images: before 9.3.0.15-r1

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_mq_operator:*:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_supplied_mq_advanced_container_images:*:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7112467

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.