Skip to content
OpenAdvisories
High 1 exploited CVE WID-SEC-2024-0521 21 CVEs

IBM MQ: Mehrere Schwachstellen

Published Feb 29, 2024 · Updated Dec 15, 2024 · Revision 13 · de-DE

Vendor: IBM Product: App Connect Enterprise Product: Business Automation Workflow Product: DataPower Gateway Product: Db2 Product: FlashSystem Product: Integration Bus Product: MQ Product: Power Hardware Management Console Product: QRadar SIEM Product: SAN Volume Controller Product: Storage Scale Product: Storwize

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

Product

IBM MQ ist eine Message Oriented Middleware von IBM.

Vulnerabilities 21

  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023
  • High 7.5
    CVE-2023-49568

    Maliciously crafted Git server replies can cause DoS on go-git clients

    A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion …

    go-git go-git zot kots Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2023-5072

    DoS Vulnerability in JSON-Java

    Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

    https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven
  • High 7.5
    CVE-2024-0553

    Gnutls: incomplete fix for cve-2023-5981

    A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-chann…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2024-25016

    IBM MQ denial of service

    IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. IBM X-Force ID: 281279.

    IBM MQ
  • High 7.3
    CVE-2023-26159

    Follow Redirects improperly handles URLs in the url.parse() function

    Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacke…

    lerna kubeflow-centraldashboard python-tensorboard js-jquery Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.2
    CVE-2023-47745

    IBM MQ Container information disclosure

    IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentials in plain clear text which can be read by a local user using a trace command.…

    IBM MQ Operator
  • Medium 5.9
    CVE-2024-27255

    IBM MQ Container information disclosure

    IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infor…

    IBM MQ Operator
  • Medium 5.5
    CVE-2022-48468

    protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

    protobuf-c protobuf-c protobuf-c libsignal-protocol-c Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-7104

    SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow

    A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer …

    SQLite SQLite3 qt6-qtwebengine qt5-qtwebengine Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2023-22081

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

    Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  • Medium 5.0
    CVE-2023-4218

    XXE in eclipse.platform / Eclipse IDE

    In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign reposi…

    Eclipse Foundation Eclipse IDE org.eclipse.pde org.eclipse.core.runtime Ubuntu Maven
  • Medium 4.1
    CVE-2023-5676

    Eclipse OpenJ9 possible infinite busy hang

    In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.

    Eclipse Foundation OpenJ9
  • Unscored —
    CVE-2001-1550

    CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which a…

  • Unscored —
    CVE-2002-1711

    BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other user…

  • Unscored —
    CVE-2002-1713

    The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world…

  • Unscored —
    CVE-2005-1941

    SilverCity before 0.9.5-r1 installs (1) cgi-styler-form.py, (2) cgi-styler.py, and (3) source2html.py with read and wri…

  • Unscored —
    CVE-2020-28241

    libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

    libmaxminddb libmaxminddb libmaxminddb Debian Ubuntu Alpine
  • Unscored —
    CVE-2023-39615

    Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libx…

    libxml2 Debian
  • Unscored —
    CVE-2023-39976

    log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not cons…

    libqb libqb libqb Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2023-45287

    Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

    Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…

    Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go

Revision history

  1. #13

    Neue Updates von IBM aufgenommen

  2. #12

    Neue Updates von IBM aufgenommen

  3. #11

    Neue Updates von IBM aufgenommen

  4. #10

    Neue Updates von IBM aufgenommen

  5. #9

    Neue Updates von IBM aufgenommen

  6. #8

    Neue Updates von IBM aufgenommen

  7. #7

    Neue Updates von IBM und IBM-APAR aufgenommen

  8. #6

    Neue Updates von IBM aufgenommen

  9. #5

    Neue Updates von IBM aufgenommen

  10. #4

    Neue Updates von IBM aufgenommen

  11. #3

    CVE-Zuordnung korrigiert

  12. #2

    Neue Updates von IBM aufgenommen

  13. #1

    Initiale Fassung

References