IBM Support

Security Bulletin: IBM QRadar SIEM is vulnerable to possible information disclosure [CVE-2023-22875]

Security Bulletin


IBM QRadar SIEM copies certificate key files used for SSL/TLS in the QRadar web user interface to managed hosts in the deployment that do not require that key. The key remains within the QRadar deployment. However, if you allow users other than QRadar system administrators to access managed hosts, such as a flow collector or event collector, those users might be able to access the webserver key. [CVE-2023-22875] This bulletin sets forth steps to mitigate the issue.

Vulnerability Details

CVEID:   CVE-2023-22875
DESCRIPTION:   IBM QRadar SIEM copies certificate key files used for SSL/TLS in the QRadar web user interface to managed hosts in the deployment that do not required that key.
CVSS Base score: 8.4
CVSS Temporal Score: See: for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

Affected Products and Versions

Affected Product(s)Version(s)
IBM QRadar SIEM7.4
IBM QRadar SIEM7.5


IBM encourages customers to update their systems promptly.

Affected Product(s)VersionsFix
IBM QRadar SIEM7.47.4.3 Fix Pack 8
IBM QRadar SIEM7.57.5.0 Update Pack 4 Interim Fix 1
IBM QRadar SIEM7.57.5.0 Update Pack 5 (Not yet available)
Note: Upgrading from 7.4.3 FP 8 to 7.5.0 UP4 will cause this issue to be reintroduced until 7.5.0 UP4 IF01 is applied.Note: For customers that have upgraded to a fixed version, there is no need to preform the mitigation steps below.

Workarounds and Mitigations

QRadar managed hosts are not intended to be accessed directly via SSH. All management of managed hosts should be done via the console. Customers in environments where access to managed hosts is permitted by users other than QRadar system administrators, such as those with changes made to permit direct SSH access to managed hosts, or who otherwise have concerns about the keys on the managed hosts can take the following steps to mitigate the risk.

Remove the key from all hosts in the deployment other than the console by executing the following command from the QRadar console to remove the key from all managed hosts.

/opt/qradar/support/ -k "> /etc/httpd/conf/certs/cert.key ; chmod 400 /etc/httpd/conf/certs/cert.key"

To validate that the fix has been applied, inspect /etc/httpd/conf/certs/cert.key and confirm the size of the cert.key file is zero bytes. This can be done on all managed hosts with the following command

/opt/qradar/support/ -k ls -lhtr /etc/httpd/conf/certs/ 

Sample Output:

192.x.x.x ->
Appliance Type: 1400    Product Version: 2021.6.3.20220829221022
 17:49:37 up 25 days, 12:27,  0 users,  load average: 0.83, 0.85, 0.64
total 4.0K
-rw-r--r-- 1 root root 1.9K Aug  6 12:38 cert.cert
-r-------- 1 root root    0 Jan 13 17:43 cert.key 

Note: The following actions will cause the key to be redistributed to managed hosts, which will require an administrator to execute the above command again to delete the newly redistributed keys. The planned fixes will eliminate this redistribution.

  1. Adding a new managed host
  2. Applying a Fix or Upgrade Pack
  3. Installing a new webserver TLS certificate using 

Get Notified about Future Security Bulletins




Change History

13 Jan 2023: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.


According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

Document Location


[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4, 7.5","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
14 February 2023