IBM Security Bulletin: IBM MQ and IBM MQ Appliance are vulnerable to a denial of service attack within the TLS key renegotiation functions (CVE-2019-4055)

A vulnerability was discovered within the TLS key renegotiation functions which could be exploited to execute a denial of service attack against an IBM MQ queue manager.

CVE(s): CVE-2019-4055

Affected product(s) and affected version(s):
IBM MQ and IBM MQ Appliance V8 versions 8.0.0.0 – 8.0.0.10
IBM MQ V9 LTS versions 9.0.0.0 – 9.0.0.5
IBM MQ and IBM MQ Appliance V9.1 LTS versions 9.1.0.0 – 9.1.0.1
IBM MQ and IBM MQ Appliance V9.1 CD versions 9.1.0 – 9.1.1

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10870484
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/156564

The post IBM Security Bulletin: IBM MQ and IBM MQ Appliance are vulnerable to a denial of service attack within the TLS key renegotiation functions (CVE-2019-4055) appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team https://ibm.co/2UjC22Z