IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ and IBM MQ Appliance

May 23, 2019 9:01 am EDT

Categorized: High Severity

Share this post:

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6, 7 and 8 used by IBM MQ and IBM MQ Appliance. IBM MQ and IBM Appliance have addressed the applicable CVEs.

CVE(s): CVE-2019-2449, CVE-2019-2422, CVE-2018-12549

Affected product(s) and affected version(s):

IBM MQ and IBM MQ Appliance 9.1 Long Term Support (LTS)
Maintenance levels 9.1.0.1 and earlier

IBM MQ and IBM MQ Appliance 9.1 Continuous Delivery (CD)
Continuous delivery update 9.1.1

IBM MQ 9.0.0.x Long Term Support (LTS)
Maintenance level 9.0.0.5 and earlier

IBM MQ and IBM MQ Appliance 8.0
Maintenance levels 8.0.0.11 and earlier

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10884286
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/155766
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/155741
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/157513

from IBM Product Security Incident Response Team https://ibm.co/2weOdEq