SB2025052303 - Multiple vulnerabilities in IBM MQ Operator



SB2025052303 - Multiple vulnerabilities in IBM MQ Operator

Published: May 23, 2025 Updated: July 18, 2025

Security Bulletin ID SB2025052303
Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2025-0395)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when the assert() function fails. A remote attacker can trigger memory corruption and perform a denial of service (DoS) attack.


2) Resource exhaustion (CVE-ID: CVE-2025-22869)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the ssh package when handling clients that complete the key exchange slowly, or not at all. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.


3) Information disclosure (CVE-ID: CVE-2024-45336)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the HTTP client will send Authorization header to a third-party domain after a chain of redirects. A remote attacker can gain unauthorized access to credentials.


4) Input validation error (CVE-ID: CVE-2025-22870)

The vulnerability allows a remote attacker to alter application's behavior.

The vulnerability exists due to insufficient validation of an IPv6 zone ID as a hostname component, when matching hosts against proxy patterns. For instance the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. A remote attacker can alter application behavior and potentially  gain access to sensitive information or functionality.


5) Memory leak (CVE-ID: CVE-2025-22866)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a small number of bits of secret scalars are leaked on the ppc64le architecture in crypto/internal/nistec. A local user can gain access to potentially sensitive information.


6) Input validation error (CVE-ID: CVE-2024-45341)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect handling of URI name constraint in certificate chains. A remote attacker can create a certificate with a URI, which has a IPv6 address with a zone ID, and bypass URI name checks.

The vulnerability affects users of private PKIs which make use of URIs.


Remediation

Install update from vendor's website.