Security Bulletin: IBM MQ is vulnerable to an issue within the Zlib library (CVE-2018-25032)

Summary

An issue was identified within the Zlib library that affects IBM MQ. IBM MQ uses Zlib to perform message compression.

Vulnerability Details

CVEID:CVE-2018-25032
**DESCRIPTION:**Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By using many distant matches, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222615 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

This issue was resolved under APAR IT40513

IBM MQ Version 8

Apply Cumulative Security Update 2 for IBM MQ Version 8.0.0.16

IBM MQ Version 9.0

Apply fix pack 9.0.0.13

IBM MQ Version 9.1 LTS

Apply interim fix for IT40513 on 9.1.0.11

IBM MQ Version 9.2 LTS

Apply fix pack 9.2.0.6

IBM MQ Version 9.1 CD and Version 9.2 CD

Upgrade to IBM MQ Version 9.3

Workarounds and Mitigations

None