Security Bulletin: IBM MQ is vulnerable to a denial of service attack due to an error within the Data Conversion logic. (CVE-2020-4310)

Summary

An issue was found within the data conversion logic that could cause a SIGSEGV and denial of service.

Vulnerability Details

CVEID:CVE-2020-4310
**DESCRIPTION:**IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD are vulnerable to a denial of service attack due to an error within the Data Conversion logic. IBM X-Force ID: 177081.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/177081 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM MQ Appliance 8
Apply FixPack 8.0.0.15

IBM MQ Appliance 9.1 LTS
Apply FixPack 9.1.0.5

IBM MQ Appliance 9.1 CD
Apply FixPack 9.1.5

Workarounds and Mitigations

None