PT-2020-18000 · Ibm · Ibm Mq Appliance+1

Published 2020-06-16 · Updated 2020-06-23 · CVE-2020-4320

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM MQ Appliance and IBM MQ AMQP Channels versions 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD

Description The issue arises from the incorrect handling of client blocking or allowance based on the certificate distinguished name SSLPEER setting.

Recommendations For versions 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD, consider restricting access to the SSLPEER setting until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-4320

Affected Products

Ibm Mq Amqp Channels

Ibm Mq Appliance

References · 4

• https://osv.dev/vulnerability/CVE-2020-4320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4320 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/177403 · Vendor Advisory
• https://ibm.com/support/pages/node/5736885 · Vendor Advisory