Input validation error in IBM MQ - CVE-2022-43919

Vulnerability identifier: #VU75590

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-43919

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling PCF messages. A remote user can send a specially crafted message to the application and perform a denial of service (DoS) attack.

IBM MQ
IBM Sterling B2B Integrator
IBM MQ for HPE NonStop
IBM Integration Bus
IBM MQ Appliance
IBM App Connect Enterprise

Install updates from vendor's website.

IBM MQ - addressed in versions 9.0.0.17, 9.2.0.10, 9.3.0.5, 9.3.2.0
IBM MQ Appliance - addressed in versions 9.2.0.10, 9.2.5.7, 9.3.0.5, 9.3.2
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1
IBM MQ for HPE NonStop - update to 8.1.0.15
IBM Integration Bus - addressed in versions 10.0.0.26, 10.1
IBM App Connect Enterprise - addressed in versions 11.0.0.20, 12.0.8.0

• https://www.ibm.com/support/pages/node/6985833

• Denial of service in IBM MQ
• Denial of service in IBM MQ Appliance
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus
• Input validation error in IBM MQ for HP NonStop Server
• Multiple vulnerabilities in IBM Sterling B2B Integrator