Security Bulletin
Summary
golang.org/x/net/html, libxml2, openssl, IBM MQ used by IBM MQ Operator and Queue Manager container images are vulnerable to denial of service by crafting an input to the Parse functions, and providing weaker than expected security which might allow an attacker to access potentially sensitive information. This bulletin identifies the steps required to address these vulnerabilities.
Vulnerability Details
CVEID: CVE-2024-21217
DESCRIPTION: Vulnerability in Java SE (component: Serialization). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS).
CVSS Source: Oracle
CVSS Base score: 3.7
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2025-23225
DESCRIPTION: IBM MQ could allow an authenticated user to cause a denial of service due to the improper handling of invalid headers sent to the queue.
CWE: CWE-230: Improper Handling of Missing Values
CVSS Source: IBM
CVSS Base score: 6.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-21210
DESCRIPTION: Vulnerability in Java SE (component: Hotspot). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some accessible data.
CWE: CWE-203: Observable Discrepancy
CVSS Source: Oracle
CVSS Base score: 3.7
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2024-21208
DESCRIPTION: Vulnerability in Java SE (component: Networking). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS).
CWE: CWE-203: Observable Discrepancy
CVSS Source: Oracle
CVSS Base score: 3.7
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2024-10917
DESCRIPTION: In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
CWE: CWE-190: Integer Overflow or Wraparound
CVSS Source: NVD
CVSS Base score: 5.3
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2025-0975
DESCRIPTION: IBM MQ console could allow an authenticated user to execute code due to improper neutralization of escape characters.
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEID: CVE-2024-54173
DESCRIPTION: IBM MQ reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.
CWE: CWE-1323: Improper Management of Sensitive Trace Data
CVSS Source: IBM
CVSS Base score: 4.7
CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2024-45338
DESCRIPTION: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
CWE: CWE-1333: Inefficient Regular Expression Complexity
CVSS Source: CISA ADP
CVSS Base score: 5.3
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2024-12797
DESCRIPTION: Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
server may fail to notice that the server was not authenticated, because
handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode
is set.
Impact summary: TLS and DTLS connections using raw public keys may be
vulnerable to man-in-middle attacks when server authentication failure is not
detected by clients.
RPKs are disabled by default in both TLS clients and TLS servers. The issue
only arises when TLS clients explicitly enable RPK use by the server, and the
server, likewise, enables sending of an RPK instead of an X.509 certificate
chain. The affected clients are those that then rely on the handshake to
fail when the server's RPK fails to match one of the expected public keys,
by setting the verification mode to SSL_VERIFY_PEER.
Clients that enable server-side raw public keys can still find out that raw
public key verification failed by calling SSL_get_verify_result(), and those
that do, and take appropriate action, are not affected. This issue was
introduced in the initial implementation of RPK support in OpenSSL 3.2.
The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
CWE: CWE-392: Missing Report of Error Condition
CVSS Source: CISA ADP
CVSS Base score: 6.3
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVEID: CVE-2024-9143
DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds memory read or write flaw due to the use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause the application to crash.
CWE: CWE-787: Out-of-bounds Write
CVSS Source: IBM X-Force
CVSS Base score: 3.7
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2024-54175
DESCRIPTION: IBM MQ could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions.
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
CVSS Source: IBM
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2022-49043
DESCRIPTION: xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.
CWE: CWE-416: Use After Free
CVSS Source: cve@mitre.org
CVSS Base score: 8.1
CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
CVEID: CVE-2025-0985
DESCRIPTION: IBM MQ stores potentially sensitive information in environment variables that could be obtained by a local user.
CWE: CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
CVSS Source: IBM
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2024-21235
DESCRIPTION: Vulnerability in Java SE (component: Hotspot). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to accessible data as well as unauthorized read access to a subset of accessible data.
CVSS Source: Oracle
CVSS Base score: 4.8
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Affected Products and Versions
Affected Product(s) | Version(s) |
IBM MQ Operator |
SC2 (formerly LTS): v3.2.0 - v3.2.8 LTS: v2.0.0 - 2.0.29 Other Release: v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2 |
IBM supplied MQ Advanced container images |
CD: 9.3.4.0-r1, 9.3.4.1-r1, 9.3.5.0-r1, 9.3.5.0-r2, 9.3.5.1-r1, 9.3.5.1-r2, 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1
|
Remediation/Fixes
Issues mentioned by this security bulletin are addressed in -
- IBM MQ Operator v3.5.0 CD release that included IBM supplied MQ Advanced 9.4.2.0-r1 container image.
- IBM MQ Operator v3.2.9 SC2 (formerly LTS) release that included IBM supplied MQ Advanced 9.4.0.10-r1 container image.
- IBM MQ Container 9.4.2.0-r1 release.
IBM strongly recommends applying the latest container images.
IBM MQ Operator v3.5.0 CD release details:
Image |
Fix Version |
Registry |
Image Location |
ibm-mq-operator |
v3.5.0 |
icr.io |
icr.io/cpopen/ibm-mq-operator@sha256:c125f82b4a20a09092f63e43d1acfe2bb1756d4916ed01034e23ffef14921560 |
ibm-mqadvanced-server |
9.4.2.0-r1 |
cp.icr.io |
cp.icr.io/cp/ibm-mqadvanced-server@sha256:4c52d2d166ed85fa8e834dad54a8887b4677c9c5f1a09a621820ed35e6688bda |
ibm-mqadvanced-server-integration |
9.4.2.0-r1 |
cp.icr.io |
cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:d5300c6f6e5c9340dcef7a2cf238c2557e374799136f51da8228c3bf7f69ed2e |
ibm-mqadvanced-server-dev |
9.4.2.0-r1 |
icr.io |
icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:943dccbb22afd7af2b8c1f8f89f48c344b91b9469677ef32b80657525708e312 |
IBM MQ Operator v3.2.9 SC2 (formerly LTS) release details:
Image |
Fix Version |
Registry |
Image Location |
ibm-mq-operator |
v3.2.9 |
icr.io |
icr.io/cpopen/ibm-mq-operator@sha256:1c40faf3e5621220d106fc37cf0f5ddc43079ce205583213a64c5c1c1ae0c779 |
ibm-mqadvanced-server |
9.4.0.10-r1 |
cp.icr.io |
cp.icr.io/cp/ibm-mqadvanced-server@sha256:8ba42da93130c6ac7e2e9f7a9ba84a0f250a3c3699790b78868810ee4994ca16 |
ibm-mqadvanced-server-integration |
9.4.0.10-r1 |
cp.icr.io |
cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:ef38bfd5d3eeb6645c918545c8dca1864c138537da7efe6edab714a0c3312cbe |
ibm-mqadvanced-server-dev |
9.4.0.10-r1 |
icr.io |
icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:b16b711efc72e7d0b0383962bd41271d77307d72605174ff06bce3225a52c7b6 |
IBM MQ Container 9.4.2.0-r1 release details:
Image |
Fix Version |
Registry |
Image Location |
ibm-mqadvanced-server |
9.4.2.0-r1 |
cp.icr.io |
cp.icr.io/cp/ibm-mqadvanced-server@sha256:4c52d2d166ed85fa8e834dad54a8887b4677c9c5f1a09a621820ed35e6688bda |
ibm-mqadvanced-server-dev |
9.4.2.0-r1 |
icr.io |
icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:943dccbb22afd7af2b8c1f8f89f48c344b91b9469677ef32b80657525708e312 |
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
https://access.redhat.com/errata/RHSA-2025:1350
https://access.redhat.com/errata/RHSA-2025:1346
https://access.redhat.com/errata/RHSA-2025:1330
Acknowledgement
Change History
28 Feb 2025: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.
Document Location
Worldwide
Was this topic helpful?
Document Information
More support for:
IBM MQ container software
Software version:
IBM MQ Operator v3.5.0, IBM MQ Operator v3.2.9, IBM MQ Container 9.4.2.0-r1
Operating system(s):
RedHat OpenShift
Document number:
7184453
Modified date:
28 February 2025
UID
ibm17184453