cvelistv5 - cve-2024-39743

CVE-2024-39743 (GCVE-0-2024-39743)

Vulnerability from cvelistv5 – Published: 2024-07-08 13:14 – Updated: 2024-08-02 04:26

Title

IBM MQ Container denial of service

Summary

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 297172.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-405 - Asymmetric Resource Consumption (Amplification)

Assigner

ibm

References

URL

Tags

	https://www.ibm.com/support/pages/node/7159714	vendor-advisory
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entry

Impacted products

	Vendor	Product	Version
	IBM	MQ Operator	Affected: 2.0.24, 3.2.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39743",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-08T17:41:53.322390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-08T19:58:56.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:16.002Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/7159714"
          },
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/297172"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MQ Operator",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.24, 3.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation.   A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  297172."
            }
          ],
          "value": "IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation.   A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  297172."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-405",
              "description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-12T13:48:40.013Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7159714"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/297172"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM MQ Container denial of service",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-39743",
    "datePublished": "2024-07-08T13:14:43.915Z",
    "dateReserved": "2024-06-28T09:34:46.056Z",
    "dateUpdated": "2024-08-02T04:26:16.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.0.0\", \"versionEndExcluding\": \"2.0.24\", \"matchCriteriaId\": \"99553BC0-D49F-46BA-B833-8A6C9A8BBDF8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.2.0\", \"versionEndIncluding\": \"2.2.2\", \"matchCriteriaId\": \"EE923D7C-C0E9-4CE1-B7B9-7694F1006550\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.3.0\", \"versionEndIncluding\": \"2.3.3\", \"matchCriteriaId\": \"F006FBC3-0F42-41B7-B4E4-ABD22F80E5FE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.4.0\", \"versionEndIncluding\": \"2.4.8\", \"matchCriteriaId\": \"266BF570-D143-4E99-A596-B2485C2E1DB7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.1.0\", \"versionEndIncluding\": \"3.1.3\", \"matchCriteriaId\": \"82E5BBE5-8A1C-44A1-BDDA-5B504F9D14E6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.2.0\", \"versionEndExcluding\": \"3.2.2\", \"matchCriteriaId\": \"64E7B54E-E5D2-4FD1-81FE-6DDC77C67684\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:mq_operator:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BF662FFB-4349-4DEF-B1AA-BFBAEE20780F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:mq_operator:3.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C238288E-9E3C-4FD8-88E7-E850DCE5B36F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation.   A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  297172.\"}, {\"lang\": \"es\", \"value\": \"IBM MQ Operador 3.2.2 e IBM MQ Operador 2.0.24 podr\\u00edan permitir a un usuario provocar una denegaci\\u00f3n de servicio en determinadas configuraciones debido a una vulnerabilidad de comparaci\\u00f3n de cadenas parciales. ID de IBM X-Force: 297172.\"}]",
      "id": "CVE-2024-39743",
      "lastModified": "2024-11-21T09:28:20.053",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@us.ibm.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2024-07-08T14:15:02.823",
      "references": "[{\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/297172\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"VDB Entry\"]}, {\"url\": \"https://www.ibm.com/support/pages/node/7159714\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/297172\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"VDB Entry\"]}, {\"url\": \"https://www.ibm.com/support/pages/node/7159714\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"psirt@us.ibm.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-405\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39743\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2024-07-08T14:15:02.823\",\"lastModified\":\"2024-11-21T09:28:20.053\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation.   A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  297172.\"},{\"lang\":\"es\",\"value\":\"IBM MQ Operador 3.2.2 e IBM MQ Operador 2.0.24 podr\u00edan permitir a un usuario provocar una denegaci\u00f3n de servicio en determinadas configuraciones debido a una vulnerabilidad de comparaci\u00f3n de cadenas parciales. ID de IBM X-Force: 297172.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-405\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.0.24\",\"matchCriteriaId\":\"99553BC0-D49F-46BA-B833-8A6C9A8BBDF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.2.0\",\"versionEndIncluding\":\"2.2.2\",\"matchCriteriaId\":\"EE923D7C-C0E9-4CE1-B7B9-7694F1006550\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.3.0\",\"versionEndIncluding\":\"2.3.3\",\"matchCriteriaId\":\"F006FBC3-0F42-41B7-B4E4-ABD22F80E5FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.4.0\",\"versionEndIncluding\":\"2.4.8\",\"matchCriteriaId\":\"266BF570-D143-4E99-A596-B2485C2E1DB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.1.0\",\"versionEndIncluding\":\"3.1.3\",\"matchCriteriaId\":\"82E5BBE5-8A1C-44A1-BDDA-5B504F9D14E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.0\",\"versionEndExcluding\":\"3.2.2\",\"matchCriteriaId\":\"64E7B54E-E5D2-4FD1-81FE-6DDC77C67684\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_operator:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF662FFB-4349-4DEF-B1AA-BFBAEE20780F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_operator:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C238288E-9E3C-4FD8-88E7-E850DCE5B36F\"}]}]}],\"references\":[{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/297172\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"VDB Entry\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7159714\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/297172\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"VDB Entry\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7159714\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7159714\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/297172\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:16.002Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39743\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-08T17:41:53.322390Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-08T19:58:53.935Z\"}}], \"cna\": {\"title\": \"IBM MQ Container denial of service\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"IBM\", \"product\": \"MQ Operator\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.24, 3.2.2\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7159714\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/297172\", \"tags\": [\"vdb-entry\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation.   A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  297172.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation.   A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  297172.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-405\", \"description\": \"CWE-405 Asymmetric Resource Consumption (Amplification)\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2024-07-12T13:48:40.013Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39743\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T04:26:16.002Z\", \"dateReserved\": \"2024-06-28T09:34:46.056Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2024-07-08T13:14:43.915Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-39743

Vulnerability from fkie_nvd - Published: 2024-07-08 14:15 - Updated: 2024-11-21 09:28

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
psirt@us.ibm.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/297172	VDB Entry
psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7159714	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/297172	VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://www.ibm.com/support/pages/node/7159714	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	mq_operator	*
ibm	mq_operator	*
ibm	mq_operator	*
ibm	mq_operator	*
ibm	mq_operator	*
ibm	mq_operator	*
ibm	mq_operator	3.0.0
ibm	mq_operator	3.0.1

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "99553BC0-D49F-46BA-B833-8A6C9A8BBDF8",
              "versionEndExcluding": "2.0.24",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE923D7C-C0E9-4CE1-B7B9-7694F1006550",
              "versionEndIncluding": "2.2.2",
              "versionStartIncluding": "2.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F006FBC3-0F42-41B7-B4E4-ABD22F80E5FE",
              "versionEndIncluding": "2.3.3",
              "versionStartIncluding": "2.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "266BF570-D143-4E99-A596-B2485C2E1DB7",
              "versionEndIncluding": "2.4.8",
              "versionStartIncluding": "2.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "82E5BBE5-8A1C-44A1-BDDA-5B504F9D14E6",
              "versionEndIncluding": "3.1.3",
              "versionStartIncluding": "3.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "64E7B54E-E5D2-4FD1-81FE-6DDC77C67684",
              "versionEndExcluding": "3.2.2",
              "versionStartIncluding": "3.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:mq_operator:3.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF662FFB-4349-4DEF-B1AA-BFBAEE20780F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:mq_operator:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C238288E-9E3C-4FD8-88E7-E850DCE5B36F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation.   A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  297172."
    },
    {
      "lang": "es",
      "value": "IBM MQ Operador 3.2.2 e IBM MQ Operador 2.0.24 podr\u00edan permitir a un usuario provocar una denegaci\u00f3n de servicio en determinadas configuraciones debido a una vulnerabilidad de comparaci\u00f3n de cadenas parciales. ID de IBM X-Force: 297172."
    }
  ],
  "id": "CVE-2024-39743",
  "lastModified": "2024-11-21T09:28:20.053",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-07-08T14:15:02.823",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/297172"
    },
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7159714"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/297172"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7159714"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-405"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

WID-SEC-W-2024-1543

Vulnerability from csaf_certbund - Published: 2024-07-08 22:00 - Updated: 2024-07-08 22:00

Summary

IBM MQ: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

IBM MQ ist eine Message Oriented Middleware von IBM.

Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen und einen Denial-of-Service-Zustand zu erzeugen.

Betroffene Betriebssysteme

- Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM MQ ist eine Message Oriented Middleware von IBM.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen und einen Denial-of-Service-Zustand zu erzeugen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1543 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1543.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1543 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1543"
      },
      {
        "category": "external",
        "summary": "IBM X-Force vom 2024-07-08",
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/297169"
      },
      {
        "category": "external",
        "summary": "IBM X-Force vom 2024-07-08",
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/297172"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2024-07-08",
        "url": "https://www.ibm.com/support/pages/node/7159714"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM MQ: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-07-08T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:10:59.126+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-1543",
      "initial_release_date": "2024-07-08T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-07-08T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Operator 2.0.24",
                "product": {
                  "name": "IBM MQ Operator 2.0.24",
                  "product_id": "T035897",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:operator_2.0.24"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Operator 3.2.2",
                "product": {
                  "name": "IBM MQ Operator 3.2.2",
                  "product_id": "T035898",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:mq:operator_3.2.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MQ"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-39742",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in IBM MQ Operator aufgrund eines partiellen String-Vergleichsproblems. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um die Authentifizierung unter bestimmten Konfigurationen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035898",
          "T035897"
        ]
      },
      "release_date": "2024-07-08T22:00:00.000+00:00",
      "title": "CVE-2024-39742"
    },
    {
      "cve": "CVE-2024-39743",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in IBM MQ Operator aufgrund eines partiellen Stringvergleichsproblems. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um unter bestimmten Konfigurationen einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035898",
          "T035897"
        ]
      },
      "release_date": "2024-07-08T22:00:00.000+00:00",
      "title": "CVE-2024-39743"
    }
  ]
}

GHSA-74R2-GJ4J-W655

Vulnerability from github – Published: 2024-07-08 15:31 – Updated: 2024-07-08 15:31

Details

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to cause a denial of service under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297172.

Severity ?

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-39743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-187",
      "CWE-405"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-08T14:15:02Z",
    "severity": "MODERATE"
  },
  "details": "IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to cause a denial of service under certain configurations due to a partial string comparison vulnerability.  IBM X-Force ID:  297172.",
  "id": "GHSA-74r2-gj4j-w655",
  "modified": "2024-07-08T15:31:56Z",
  "published": "2024-07-08T15:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39743"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/297172"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7159714"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-39743 (GCVE-0-2024-39743)

FKIE_CVE-2024-39743

WID-SEC-W-2024-1543

GHSA-74R2-GJ4J-W655

Tags

Sightings

Nomenclature