IBM MQ Operator & Container Images Multiple Vulnerabilities Fix (CVE-2023-28986, CVE-2023-28983)

Critical Vulnerability Information Vulnerability Overview Multiple vulnerabilities in IBM MQ Operator and Queue Manager container images have been resolved. Vulnerability Details 1. CVE-2023-41515 - Description: A logic error when processing specific certificates may lead to a denial-of-service condition. - CVSS Score: 6.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2. CVE-2023-28986 - Description: A path traversal vulnerability exists, which attackers could exploit to access restricted resources. - CVSS Score: 7.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 3. CVE-2023-28987 - Description: In the propagation feature of MQ release 7.1 and later, authenticated users can bypass authorization checks, leading to unauthorized data writes. - CVSS Score: 6.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4. CVE-2023-3044 - Description: Improper TLS configuration in IBM MQ may enable man-in-the-middle attacks. - CVSS Score: 6.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 5. CVE-2023-4224 - Description: Buffer overflow risk may exist when processing AOT data using the GraalVM compiler. - CVSS Score: 7.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 6. CVE-2023-28983 - Description: A deserialization vulnerability in WebSphere Liberty may lead to remote code execution. - CVSS Score: 9.1 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected Products and Versions IBM MQ Operator: v2.0.0 to v2.0.2 IBM MQ Advanced container images: Multiple versions affected Remediation New container images have been released to address the above vulnerabilities. Detailed remediation steps and download links are provided. Workarounds and Mitigations No specific workarounds or mitigations are available at this time. References Links to relevant security advisories and documentation are provided.

Goal Reached Thanks to every supporter — we hit 100%!

IBM MQ Operator & Container Images Multiple Vulnerabilities Fix (CVE-2023-28986, CVE-2023-28983)