CVE-2020-4320
First published: Wed Mar 11 2020(Updated: )
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. IBM X-Force ID: 177403.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM WebSphere MQ Light | <=9.1 LTS | |
| IBM WebSphere MQ Light | <=9.0 LTS | |
| IBM WebSphere MQ Light | <=8.0 | |
| IBM WebSphere MQ Light | <=9.1 CD | |
| IBM WebSphere MQ Light | >=8.0.0.0<8.0.0.15 | |
| IBM WebSphere MQ Light | >=9.0.0.0<9.0.0.10 | |
| IBM WebSphere MQ Light | >=9.1.0<9.1.5 | |
| IBM WebSphere MQ Light | >=9.1.0.0<9.1.0.5 | |
| HPE HP-UX | ||
| IBM AIX | ||
| Linux Kernel | ||
| Microsoft Windows Operating System | ||
| Oracle Solaris and Zettabyte File System (ZFS) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-4320?
The severity of CVE-2020-4320 is medium with a severity value of 6.5.
What is IBM MQ Appliance and IBM MQ AMQP Channels?
IBM MQ Appliance and IBM MQ AMQP Channels are messaging solutions provided by IBM.
Which versions of IBM MQ are affected by CVE-2020-4320?
IBM MQ versions 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD are affected by CVE-2020-4320.
What is SSLPEER setting?
SSLPEER setting is a setting that allows blocking or allowing clients based on the certificate distinguished name.
Is IBM MQ Appliance vulnerable to CVE-2020-4320?
Yes, IBM MQ Appliance is vulnerable to CVE-2020-4320.
- agent/references
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- vendor/ibm
- canonical/ibm websphere mq light
- version/ibm websphere mq light/9.1 lts
- version/ibm websphere mq light/9.0 lts
- version/ibm websphere mq light/8.0
- version/ibm websphere mq light/9.1 cd
- version/ibm websphere mq light/8.0.0.0
- version/ibm websphere mq light/9.0.0.0
- version/ibm websphere mq light/9.1.0
- version/ibm websphere mq light/9.1.0.0
- vendor/hp
- canonical/hpe hp-ux
- canonical/ibm aix
- vendor/linux
- canonical/linux kernel
- vendor/microsoft
- canonical/microsoft windows operating system
- vendor/oracle
- canonical/oracle solaris and zettabyte file system (zfs)