CVE-2020-4320: Medium severity ibm websphere mq light vulnerability
Published Mar 11, 2020
·Updated
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. IBM X-Force ID: 177403.
Other sources
IBM MQ Appliance, IBM MQ, AMQP Channels do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting.
— IBM
Affected Software
13 affected components
IBM MQ<=9.1 LTS
IBM MQ<=9.0 LTS
IBM MQ<=8.0
IBM MQ<=9.1 CD
IBM MQ>=8.0.0.0<8.0.0.15
IBM MQ>=9.0.0.0<9.0.0.10
IBM MQ>=9.1.0<9.1.5
IBM MQ>=9.1.0.0<9.1.0.5
HP HP-UX
IBM AIX
Linux Linux kernel
Microsoft Windows
Oracle Solaris
Event History
Mar 11, 2020
CVE Published
via IBM·12:00 AM
Jun 16, 2020
CVE Published
via MITRE·01:45 PM
Data Sourced
via MITRE·01:45 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-4320?
The severity of CVE-2020-4320 is medium with a severity value of 6.5.
2
What is IBM MQ Appliance and IBM MQ AMQP Channels?
IBM MQ Appliance and IBM MQ AMQP Channels are messaging solutions provided by IBM.
3
Which versions of IBM MQ are affected by CVE-2020-4320?
IBM MQ versions 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD are affected by CVE-2020-4320.
4
What is SSLPEER setting?
SSLPEER setting is a setting that allows blocking or allowing clients based on the certificate distinguished name.
5
Is IBM MQ Appliance vulnerable to CVE-2020-4320?
Yes, IBM MQ Appliance is vulnerable to CVE-2020-4320.