IBM Support

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to golang.org/x/net/html, libxml2 and openssl

Security Bulletin


Summary

golang.org/x/net/html, libxml2, openssl, IBM MQ used by IBM MQ Operator and Queue Manager container images are vulnerable to denial of service by crafting an input to the Parse functions, and providing weaker than expected security which might allow an attacker to access potentially sensitive information. This bulletin identifies the steps required to address these vulnerabilities.

Vulnerability Details

CVEID:   CVE-2024-21217
DESCRIPTION:   Vulnerability in Java SE (component: Serialization). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS).
CVSS Source:   Oracle
CVSS Base score:   3.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2025-23225
DESCRIPTION:   IBM MQ could allow an authenticated user to cause a denial of service due to the improper handling of invalid headers sent to the queue.
CWE:   CWE-230: Improper Handling of Missing Values
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2024-21210
DESCRIPTION:   Vulnerability in Java SE (component: Hotspot). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some accessible data.
CWE:   CWE-203: Observable Discrepancy
CVSS Source:   Oracle
CVSS Base score:   3.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2024-21208
DESCRIPTION:   Vulnerability in Java SE (component: Networking). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS).
CWE:   CWE-203: Observable Discrepancy
CVSS Source:   Oracle
CVSS Base score:   3.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2024-10917
DESCRIPTION:   In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
CWE:   CWE-190: Integer Overflow or Wraparound
CVSS Source:   NVD
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2025-0975
DESCRIPTION:   IBM MQ console could allow an authenticated user to execute code due to improper neutralization of escape characters. 
CWE:   CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVEID:   CVE-2024-54173
DESCRIPTION:   IBM MQ reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.
CWE:   CWE-1323: Improper Management of Sensitive Trace Data
CVSS Source:   IBM
CVSS Base score:   4.7
CVSS Vector:   (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2024-45338
DESCRIPTION:   An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
CWE:   CWE-1333: Inefficient Regular Expression Complexity
CVSS Source:   CISA ADP
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2024-12797
DESCRIPTION:   Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain. The affected clients are those that then rely on the handshake to fail when the server's RPK fails to match one of the expected public keys, by setting the verification mode to SSL_VERIFY_PEER. Clients that enable server-side raw public keys can still find out that raw public key verification failed by calling SSL_get_verify_result(), and those that do, and take appropriate action, are not affected. This issue was introduced in the initial implementation of RPK support in OpenSSL 3.2. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
CWE:   CWE-392: Missing Report of Error Condition
CVSS Source:   CISA ADP
CVSS Base score:   6.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID:   CVE-2024-9143
DESCRIPTION:   OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds memory read or write flaw due to the use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause the application to crash.
CWE:   CWE-787: Out-of-bounds Write
CVSS Source:   IBM X-Force
CVSS Base score:   3.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2024-54175
DESCRIPTION:   IBM MQ could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions.
CWE:   CWE-754: Improper Check for Unusual or Exceptional Conditions
CVSS Source:   IBM
CVSS Base score:   5.5
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2022-49043
DESCRIPTION:   xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.
CWE:   CWE-416: Use After Free
CVSS Source:   cve@mitre.org
CVSS Base score:   8.1
CVSS Vector:   (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2025-0985
DESCRIPTION:   IBM MQ stores potentially sensitive information in environment variables that could be obtained by a local user.
CWE:   CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
CVSS Source:   IBM
CVSS Base score:   5.5
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2024-21235
DESCRIPTION:   Vulnerability in Java SE (component: Hotspot). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to accessible data as well as unauthorized read access to a subset of accessible data.
CVSS Source:   Oracle
CVSS Base score:   4.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)Version(s)
IBM MQ Operator

SC2 (formerly LTS): v3.2.0 - v3.2.8
CD:  v3.0.0, v3.0.1, v3.1.0 - 3.1.3, v3.3.0, v3.4.0, v3.4.1

LTS: v2.0.0 - 2.0.29

Other Release: v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2

IBM supplied MQ Advanced container images

CD: 9.3.4.0-r1, 9.3.4.1-r1, 9.3.5.0-r1, 9.3.5.0-r2, 9.3.5.1-r1, 9.3.5.1-r2, 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1

LTS: 9.2.0.1-r1-eus, 9.2.0.2-r1-eus, 9.2.0.2-r2-eus, 9.2.0.4-r1-eus, 9.2.0.5-r1-eus, 
9.2.0.5-r2-eus, 9.2.0.5-r3-eus, 9.2.0.6-r1-eus, 9.2.0.6-r2-eus, 9.2.0.6-r3-eus, 9.2.3.0-r1, 
9.2.4.0-r1, 9.2.5.0-r1, 9.2.5.0-r2, 9.2.5.0-r3, 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 
9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 
9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2, 9.4.0.6-r1, 9.4.0.6-r2, 9.4.0.7-r1


Other Release: 9.2.0.1-r1-eus, 9.2.0.2-r1-eus, 9.2.0.2-r2-eus, 9.2.0.4-r1-eus, 9.2.0.5-r1-eus, 9.2.0.5-r2-eus, 9.2.0.5-r3-eus, 9.2.0.6-r1-eus, 9.2.0.6-r2-eus, 9.2.0.6-r3-eus, 9.2.3.0-r1, 9.2.4.0-r1, 9.2.5.0-r1, 9.2.5.0-r2, 9.2.5.0-r3, 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4,  9.3.0.3-r1,  9.3.0.4-r1, 9.3.0.4-r2,  9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3,  9.3.0.6-r1,  9.3.1.0-r1, 9.3.1.0-r2, 9.3.1.0-r3, 9.3.1.1-r1, 9.3.2.0-r1, 9.3.2.0-r2, 9.3.2.1-r1, 9.3.2.1-r2,  9.3.3.0-r1, 9.3.3.0-r2, 9.3.3.1-r1, 9.3.3.1-r2, 9.3.3.2-r1, 9.3.3.2-r2, 9.3.3.2-r3, ,9.3.3.3-r1, 9.3.3.3-r2

 

Remediation/Fixes

Issues mentioned by this security bulletin are addressed in -

  • IBM MQ Operator v3.5.0 CD release that included IBM supplied MQ Advanced 9.4.2.0-r1 container image. 
  • IBM MQ Operator v3.2.9 SC2 (formerly LTS) release that included IBM supplied MQ Advanced 9.4.0.10-r1 container image.
  • IBM MQ Container 9.4.2.0-r1 release.

IBM strongly recommends applying the latest container images. 

 

IBM MQ Operator v3.5.0 CD release details:

Image

Fix Version

Registry

Image Location

ibm-mq-operator

v3.5.0

icr.io

icr.io/cpopen/ibm-mq-operator@sha256:c125f82b4a20a09092f63e43d1acfe2bb1756d4916ed01034e23ffef14921560

ibm-mqadvanced-server

9.4.2.0-r1

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server@sha256:4c52d2d166ed85fa8e834dad54a8887b4677c9c5f1a09a621820ed35e6688bda

ibm-mqadvanced-server-integration

9.4.2.0-r1

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:d5300c6f6e5c9340dcef7a2cf238c2557e374799136f51da8228c3bf7f69ed2e

ibm-mqadvanced-server-dev

9.4.2.0-r1

icr.io

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:943dccbb22afd7af2b8c1f8f89f48c344b91b9469677ef32b80657525708e312


IBM MQ Operator v3.2.9 SC2 (formerly LTS) release details:

Image

Fix Version

Registry

Image Location

ibm-mq-operator

v3.2.9

icr.io

icr.io/cpopen/ibm-mq-operator@sha256:1c40faf3e5621220d106fc37cf0f5ddc43079ce205583213a64c5c1c1ae0c779

ibm-mqadvanced-server

9.4.0.10-r1

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server@sha256:8ba42da93130c6ac7e2e9f7a9ba84a0f250a3c3699790b78868810ee4994ca16

ibm-mqadvanced-server-integration

9.4.0.10-r1

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:ef38bfd5d3eeb6645c918545c8dca1864c138537da7efe6edab714a0c3312cbe

ibm-mqadvanced-server-dev

9.4.0.10-r1

icr.io

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:b16b711efc72e7d0b0383962bd41271d77307d72605174ff06bce3225a52c7b6

 

IBM MQ Container 9.4.2.0-r1 release details:

Image

Fix Version

Registry

Image Location

ibm-mqadvanced-server

9.4.2.0-r1

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server@sha256:4c52d2d166ed85fa8e834dad54a8887b4677c9c5f1a09a621820ed35e6688bda

ibm-mqadvanced-server-dev

9.4.2.0-r1

icr.io

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:943dccbb22afd7af2b8c1f8f89f48c344b91b9469677ef32b80657525708e312


Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

Change History

28 Feb 2025: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

Document Location

Worldwide


[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSFE2G","label":"IBM MQ container software"},"Component":"","Platform":[{"code":"PF040","label":"RedHat OpenShift"}],"Version":"IBM MQ Operator v3.5.0, IBM MQ Operator v3.2.9, IBM MQ Container 9.4.2.0-r1","Edition":"","Line of Business":{"code":"LOB77","label":"Automation Platform"}}]

Document Information

More support for:
IBM MQ container software

Software version:
IBM MQ Operator v3.5.0, IBM MQ Operator v3.2.9, IBM MQ Container 9.4.2.0-r1

Operating system(s):
RedHat OpenShift

Document number:
7184453

Modified date:
28 February 2025

UID

ibm17184453

Manage My Notification Subscriptions