Mq Advanced Container Images
Monthly
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority to perform MQPUT operations crash the queue manager or potentially execute arbitrary code by supplying malformed message options. The advisory is scoped to these containerized IBM MQ products, and exploitation requires valid MQ credentials plus put authority, so this is not an unauthenticated attack. No public exploit identified at time of analysis, and IBM has released a vendor patch.
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Container Images result from a heap buffer overflow when an authenticated attacker with put authority sends MQPUT or MQPUT1 operations carrying malformed message handle properties. The CVSS 8.8 vector is network-reachable and requires no user interaction, but the PR:L component means the attacker must already hold valid credentials and put permissions, so the practical threat is an insider or post-compromise actor rather than an unauthenticated remote attacker. No public exploit code was identified at time of analysis, and IBM has released a vendor patch.
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOPEN operations that are not properly validated for buffer size. The affected deployments identified in the CPE data are IBM MQ Operator and IBM MQ Advanced Container Images, with the provided feed using wildcard version fields rather than a precise version range. The vendor CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring valid MQ credentials and authority to open a queue or object; no public exploit was identified at time of analysis, and a vendor patch is available via IBM support advisory node 7292667.
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestricted Java deserialization in MQ Classes for Java to cause a denial of service or potentially execute arbitrary code. The issue is rated CVSS 7.5 with high attack complexity (AC:H), reflecting the need for a usable gadget chain on the application classpath; absent one, impact is more likely limited to denial of service. Exploitation requires valid credentials and reachability of the deserialization path. No public exploit was identified at time of analysis, and a vendor patch is available per IBM's advisory.
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Advanced container images when a TLS-secured channel parses a client certificate whose distinguished name is malformed, overflowing a fixed-size stack buffer during connection establishment. The flaw (CWE-121) sits in the pre-authentication TLS handshake path, so no credentials or user interaction are required (CVSS 8.1, AV:N/AC:H/PR:N/UI:N), though the high attack-complexity rating reflects how difficult it is to turn the stack corruption into reliable code execution and the precondition that the targeted queue manager must actually have TLS enabled on a reachable channel. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a credible but not emergency-priority issue: patch on a normal cycle while reducing exposure of TLS listeners.
Denial of service in IBM MQ client applications that consume messages asynchronously can be triggered when a queue name carrying an improperly validated length value reaches the client, producing a buffer overflow (CWE-120) that crashes or hangs the consuming application. The flaw affects IBM MQ Operator and IBM MQ Advanced Container Images deployments and is reachable either by an attacker who already controls the queue manager or by a man-in-the-middle able to tamper with message metadata on unencrypted, non-TLS channels. IBM has released a vendor patch per its support advisory, no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.9 score reflects availability-only impact with high attack complexity.
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queue manager by sending an MQOPEN request whose offset values are not properly validated, producing a buffer-handling fault in the queue manager process. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) shows the limiting factor is credentials: the attacker must already hold a valid MQ identity and an established connection able to issue MQ API calls, so exposure is limited to insiders or attackers who have compromised an MQ application identity. Confidentiality and integrity are unaffected, the vendor has published a fix, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no).
Authenticated IBM MQ clients can cause a bounded denial of service and obtain limited information about process memory layout in IBM MQ Operator and IBM MQ Advanced Container Images deployments by sending a specially crafted request that triggers an out-of-bounds read. The issue requires a valid MQ client session and network access to the queue manager listener, and impact is limited to availability and low-confidentiality disclosure rather than code execution or data modification. No public exploit was identified at time of analysis, and IBM has published a vendor patch.
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container images - lets a remote user who already holds valid MQ credentials crash the queue manager by sending specially crafted multicast status messages that drive the process into a NULL pointer dereference. Impact is availability-only (CVSS 6.5, A:H with C:N/I:N); confidentiality and integrity are unaffected. Exploitation is further constrained because the target deployment must have multicast messaging configured and enabled, a non-default capability absent from most standard queue-manager installations, and no public exploit has been identified at time of analysis.
Authenticated users of IBM MQ Operator and IBM MQ Advanced container image deployments can cause a denial of service against the queue manager by submitting malformed RFH2 message header fields through queued publish/subscribe operations. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting high availability impact only - there is no disclosure or modification of message data - and requires valid MQ credentials with authorization to publish or subscribe, so anonymous remote parties are not positioned to exploit it. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published remediation guidance; the practical exposure is limited to environments that both grant the attacker a usable principal and expose queued pub/sub messaging.
Denial of service in IBM MQ Operator and MQ Advanced Container Images allows an authenticated MQ client to crash the queue manager agent by sending a crafted asynchronous consume request that triggers untrusted deserialization (CWE-502). The CVSS 6.5 vector confirms network reachability, low privileges (PR:L), no user interaction, and availability-only impact; confidentiality and integrity are unaffected, and this is a moderate-priority availability issue rather than a top-tier emergency. No public exploit was identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and IBM has published a vendor patch.
Path traversal in IBM MQ Web Console allows an authenticated administrator to write files outside the intended directory in deployments using IBM MQ Operator or IBM MQ Advanced Container Images. The issue is low severity (CVSS 2.7) with integrity-only impact and a high privilege prerequisite, and no public exploit identified at time of analysis; a vendor patch is available per IBM advisory.
Malformed compressed message data delivered to containerized IBM MQ deployments (MQ Operator and MQ Advanced Container Images) can drive a minor out-of-bounds read (CWE-125) in the decompression code path, but the broker rejects the malformed request and does not return the over-read bytes, so no message or memory contents are exposed. The attacker must already hold valid MQ connection credentials (CVSS PR:L) and clear high attack complexity (AC:H) by crafting a specific malformed compressed structure, keeping the issue at CVSS 3.1 (Low). No public exploit code or active exploitation has been identified at time of analysis, and IBM has published a vendor fix via its support portal.
Authenticated IBM MQ users holding valid queue-manager credentials can trigger an off-by-one buffer overflow by submitting a specially crafted object name, causing process instability or a crash of MQ components. The impact is availability-only (CVSS 4.3, PR:L, A:L) with no path to data disclosure or code execution, and the CPE data confines affected deployments to containerized environments - IBM MQ Operator and IBM MQ Advanced Container Images - rather than traditional MQ installations. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory authentication step sharply limits exposure to insiders or attackers who have already obtained MQ credentials.
IBM MQ Operator and MQ Advanced container images can be driven into a denial-of-service condition by an authenticated queue-manager user who submits a specially crafted message that forces excessive memory operations during character-set (CCSID) conversion; the CVSS 3.1 score is 5.3 with an all-availability impact, high attack complexity, and low privileges required. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not provided, so this is a moderate-severity, low-priority issue rather than an urgent threat. Impact is confined to service disruption - there is no confidentiality or integrity exposure from the conversion fault itself.
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority to perform MQPUT operations crash the queue manager or potentially execute arbitrary code by supplying malformed message options. The advisory is scoped to these containerized IBM MQ products, and exploitation requires valid MQ credentials plus put authority, so this is not an unauthenticated attack. No public exploit identified at time of analysis, and IBM has released a vendor patch.
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Container Images result from a heap buffer overflow when an authenticated attacker with put authority sends MQPUT or MQPUT1 operations carrying malformed message handle properties. The CVSS 8.8 vector is network-reachable and requires no user interaction, but the PR:L component means the attacker must already hold valid credentials and put permissions, so the practical threat is an insider or post-compromise actor rather than an unauthenticated remote attacker. No public exploit code was identified at time of analysis, and IBM has released a vendor patch.
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOPEN operations that are not properly validated for buffer size. The affected deployments identified in the CPE data are IBM MQ Operator and IBM MQ Advanced Container Images, with the provided feed using wildcard version fields rather than a precise version range. The vendor CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring valid MQ credentials and authority to open a queue or object; no public exploit was identified at time of analysis, and a vendor patch is available via IBM support advisory node 7292667.
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestricted Java deserialization in MQ Classes for Java to cause a denial of service or potentially execute arbitrary code. The issue is rated CVSS 7.5 with high attack complexity (AC:H), reflecting the need for a usable gadget chain on the application classpath; absent one, impact is more likely limited to denial of service. Exploitation requires valid credentials and reachability of the deserialization path. No public exploit was identified at time of analysis, and a vendor patch is available per IBM's advisory.
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Advanced container images when a TLS-secured channel parses a client certificate whose distinguished name is malformed, overflowing a fixed-size stack buffer during connection establishment. The flaw (CWE-121) sits in the pre-authentication TLS handshake path, so no credentials or user interaction are required (CVSS 8.1, AV:N/AC:H/PR:N/UI:N), though the high attack-complexity rating reflects how difficult it is to turn the stack corruption into reliable code execution and the precondition that the targeted queue manager must actually have TLS enabled on a reachable channel. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a credible but not emergency-priority issue: patch on a normal cycle while reducing exposure of TLS listeners.
Denial of service in IBM MQ client applications that consume messages asynchronously can be triggered when a queue name carrying an improperly validated length value reaches the client, producing a buffer overflow (CWE-120) that crashes or hangs the consuming application. The flaw affects IBM MQ Operator and IBM MQ Advanced Container Images deployments and is reachable either by an attacker who already controls the queue manager or by a man-in-the-middle able to tamper with message metadata on unencrypted, non-TLS channels. IBM has released a vendor patch per its support advisory, no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.9 score reflects availability-only impact with high attack complexity.
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queue manager by sending an MQOPEN request whose offset values are not properly validated, producing a buffer-handling fault in the queue manager process. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) shows the limiting factor is credentials: the attacker must already hold a valid MQ identity and an established connection able to issue MQ API calls, so exposure is limited to insiders or attackers who have compromised an MQ application identity. Confidentiality and integrity are unaffected, the vendor has published a fix, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no).
Authenticated IBM MQ clients can cause a bounded denial of service and obtain limited information about process memory layout in IBM MQ Operator and IBM MQ Advanced Container Images deployments by sending a specially crafted request that triggers an out-of-bounds read. The issue requires a valid MQ client session and network access to the queue manager listener, and impact is limited to availability and low-confidentiality disclosure rather than code execution or data modification. No public exploit was identified at time of analysis, and IBM has published a vendor patch.
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container images - lets a remote user who already holds valid MQ credentials crash the queue manager by sending specially crafted multicast status messages that drive the process into a NULL pointer dereference. Impact is availability-only (CVSS 6.5, A:H with C:N/I:N); confidentiality and integrity are unaffected. Exploitation is further constrained because the target deployment must have multicast messaging configured and enabled, a non-default capability absent from most standard queue-manager installations, and no public exploit has been identified at time of analysis.
Authenticated users of IBM MQ Operator and IBM MQ Advanced container image deployments can cause a denial of service against the queue manager by submitting malformed RFH2 message header fields through queued publish/subscribe operations. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting high availability impact only - there is no disclosure or modification of message data - and requires valid MQ credentials with authorization to publish or subscribe, so anonymous remote parties are not positioned to exploit it. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published remediation guidance; the practical exposure is limited to environments that both grant the attacker a usable principal and expose queued pub/sub messaging.
Denial of service in IBM MQ Operator and MQ Advanced Container Images allows an authenticated MQ client to crash the queue manager agent by sending a crafted asynchronous consume request that triggers untrusted deserialization (CWE-502). The CVSS 6.5 vector confirms network reachability, low privileges (PR:L), no user interaction, and availability-only impact; confidentiality and integrity are unaffected, and this is a moderate-priority availability issue rather than a top-tier emergency. No public exploit was identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and IBM has published a vendor patch.
Path traversal in IBM MQ Web Console allows an authenticated administrator to write files outside the intended directory in deployments using IBM MQ Operator or IBM MQ Advanced Container Images. The issue is low severity (CVSS 2.7) with integrity-only impact and a high privilege prerequisite, and no public exploit identified at time of analysis; a vendor patch is available per IBM advisory.
Malformed compressed message data delivered to containerized IBM MQ deployments (MQ Operator and MQ Advanced Container Images) can drive a minor out-of-bounds read (CWE-125) in the decompression code path, but the broker rejects the malformed request and does not return the over-read bytes, so no message or memory contents are exposed. The attacker must already hold valid MQ connection credentials (CVSS PR:L) and clear high attack complexity (AC:H) by crafting a specific malformed compressed structure, keeping the issue at CVSS 3.1 (Low). No public exploit code or active exploitation has been identified at time of analysis, and IBM has published a vendor fix via its support portal.
Authenticated IBM MQ users holding valid queue-manager credentials can trigger an off-by-one buffer overflow by submitting a specially crafted object name, causing process instability or a crash of MQ components. The impact is availability-only (CVSS 4.3, PR:L, A:L) with no path to data disclosure or code execution, and the CPE data confines affected deployments to containerized environments - IBM MQ Operator and IBM MQ Advanced Container Images - rather than traditional MQ installations. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory authentication step sharply limits exposure to insiders or attackers who have already obtained MQ credentials.
IBM MQ Operator and MQ Advanced container images can be driven into a denial-of-service condition by an authenticated queue-manager user who submits a specially crafted message that forces excessive memory operations during character-set (CCSID) conversion; the CVSS 3.1 score is 5.3 with an all-availability impact, high attack complexity, and low privileges required. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not provided, so this is a moderate-severity, low-priority issue rather than an urgent threat. Impact is confined to service disruption - there is no confidentiality or integrity exposure from the conversion fault itself.