Security Bulletin: IBM MQ AMQP Listeners are vulnerable to a session fixation attack (CVE-2019-4227)

Summary

An error was found in the IBM MQ AMQP logic that could result in a session fixation attack.

Vulnerability Details

CVEID: CVE-2019-4227 DESCRIPTION: IBM MQ AMQP Listeners could allow an unauthorized user to conduct a session fixation attack because of improper handling of client disconnection.
CVSS Base Score: 5.6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159352&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

IBM MQ V8

versions 8.0.0.4 - 8.0.0.12

IBM MQ V9.0LTS

versions 9.0.0.0 - 9.0.0.6

IBM MQ V9.1 LTS

versions 9.1.0.0 - 9.1.0.2

IBM MQ V9.1 CD

versions 9.1.0 - 9.1.2

Remediation/Fixes

IBM MQ V8

Apply Fixpack 8.0.013

IBM MQ V9.0LTS

Apply Fixpack 9.0.0.7

IBM MQ V9.1 LTS

Apply Fixpack 9.1.0.3

IBM MQ V9.1 CD

Upgrade to IBM MQ 9.1.3

Workarounds and Mitigations

None.