IBM MQ is vulnerable to a denial of service attack

Overview :
A vulnerability was found in the clustering code that caused a memory leak. This could be exploited by an attacker to execute a denial of service attack against a queue manager.
Affected Product(s) :
 

  • IBM WebSphere MQ V7.1
    versions 7.1.0.0 – 7.1.0.9
    IBM WepSphere MQ V7.5
    versions 7.5.0.0 – 7.5.0.9
    IBM MQ and IBM MQ Appliance V8
    versions 8.0.0.0 – 8.0.0.11
    IBM MQ V9 LTS
    versions 9.0.0.0 – 9.0.0.6
    IBM MQ and IBM MQ Appliance v9.1 LTS
    versions 9.1.0.0 – 9.1.0.2
    IBM MQ and IBM MQ Appliance v9.1 CD
    versions 9.1.1 – 9.1.2
Vulnerability Details :
CVE ID : CVE-2019-4141
IBM MQ is vulnerable to a denial of service attack caused by a memory leak in the clustering code.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/158337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

Solution :

    • IBM WebSphere MQ V7.1
      Contact IBM Support requesting a fix for APAR IT27859
      IBM WepSphere MQ V7.5
      Contact IBM Support requesting a fix for APAR IT27859
      IBM MQ and IBM MQ Appliance V8
      IBM MQ V9 LTS
      IBM MQ and IBM MQ Appliance V9.1 LTS
      IBM MQ and IBM MQ Appliance V9.1 CD
      Upgrade to IBM MQ 9.1.3

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2022-1840 : Home Clean Services Management System Stored Cross-Site Scripting (XSS)

CVE-2022-1840 : Home Clean Services Management System Stored Cross-Site Scripting (XSS)

Description Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being

CVE-2022-1558 : Multiple Stored Cross-Site Scripting vulnerabilities in WordPress curtain plugin 1.0.2

CVE-2022-1558 : Multiple Stored Cross-Site Scripting vulnerabilities in WordPress curtain plugin 1.0.2

Description Several Cross-Site Scripting vulnerabilities in the Curtain WordPress plugin. Due to these Cross-Site Scripting vulnerabilities, an attacker would be

CVE-2022-AVAST2 : Self-Defense Bypass via Repairing Function

CVE-2022-AVAST2 : Self-Defense Bypass via Repairing Function

Description It was noted that there is security checking to prevent some of the Avast processes from loading of undesired/unsigned