CVE-2025-36005: IBM MQ Operator information disclosure

Published Jul 23, 2025
·
Updated

IBM MQ Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation.

Other sources

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation.

— MITRE

Affected Software

63 affected components
IBM MQ Operator LTS>=2.0.0<=2.0.29
IBM MQ Operator CD>=3.1.0<3.1.3
IBM MQ Operator SC2>=3.2.0<=3.2.13
IBM MQ Operator<=SC2: v3.2.0 - v3.2.13 CD:  v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.6.0 LTS: v2.0.0 - 2.0.29
IBM supplied MQ Advanced container images<=SC2: 9.4.0.6-r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2
IBM MQ Operator>=2.0.0<=2.0.29
IBM MQ Operator>=3.2.0<=3.2.13
IBM MQ Operator>=3.5.1<=3.6.0
IBM MQ Operator=3.3.0
IBM MQ Operator=3.4.0
IBM MQ Operator=3.4.1
IBM MQ Operator=3.5.0
IBM supplied MQ Advanced container images=9.3.0.0-r1
IBM supplied MQ Advanced container images=9.3.0.0-r2
IBM supplied MQ Advanced container images=9.3.0.0-r3
IBM supplied MQ Advanced container images=9.3.0.1-r1
IBM supplied MQ Advanced container images=9.3.0.1-r2
IBM supplied MQ Advanced container images=9.3.0.1-r3
IBM supplied MQ Advanced container images=9.3.0.1-r4
IBM supplied MQ Advanced container images=9.3.0.3-r1
IBM supplied MQ Advanced container images=9.3.0.4-r1
IBM supplied MQ Advanced container images=9.3.0.4-r2
IBM supplied MQ Advanced container images=9.3.0.5-r1
IBM supplied MQ Advanced container images=9.3.0.5-r2
IBM supplied MQ Advanced container images=9.3.0.5-r3
IBM supplied MQ Advanced container images=9.3.0.6-r1
IBM supplied MQ Advanced container images=9.3.0.10-r1
IBM supplied MQ Advanced container images=9.3.0.10-r2
IBM supplied MQ Advanced container images=9.3.0.11-r1
IBM supplied MQ Advanced container images=9.3.0.11-r2
IBM supplied MQ Advanced container images=9.3.0.15-r1
IBM supplied MQ Advanced container images=9.3.0.16-r1
IBM supplied MQ Advanced container images=9.3.0.16-r2
IBM supplied MQ Advanced container images=9.3.0.17-r1
IBM supplied MQ Advanced container images=9.3.0.17-r2
IBM supplied MQ Advanced container images=9.3.0.17-r3
IBM supplied MQ Advanced container images=9.3.0.20-r1
IBM supplied MQ Advanced container images=9.3.0.20-r2
IBM supplied MQ Advanced container images=9.3.0.21-r1
IBM supplied MQ Advanced container images=9.3.0.21-r2
IBM supplied MQ Advanced container images=9.3.0.21-r3
IBM supplied MQ Advanced container images=9.3.0.25-r1
IBM supplied MQ Advanced container images=9.4.0.0-r1
IBM supplied MQ Advanced container images=9.4.0.0-r2
IBM supplied MQ Advanced container images=9.4.0.0-r3
IBM supplied MQ Advanced container images=9.4.0.5-r1
IBM supplied MQ Advanced container images=9.4.0.5-r2
IBM supplied MQ Advanced container images=9.4.0.6-r1
IBM supplied MQ Advanced container images=9.4.0.6-r2
IBM supplied MQ Advanced container images=9.4.0.7-r1
IBM supplied MQ Advanced container images=9.4.0.10-r1
IBM supplied MQ Advanced container images=9.4.0.10-r2
IBM supplied MQ Advanced container images=9.4.0.11-r1
IBM supplied MQ Advanced container images=9.4.0.11-r2
IBM supplied MQ Advanced container images=9.4.0.11-r3
IBM supplied MQ Advanced container images=9.4.1.0-r1
IBM supplied MQ Advanced container images=9.4.1.0-r2
IBM supplied MQ Advanced container images=9.4.1.1-r1
IBM supplied MQ Advanced container images=9.4.2.0-r1
IBM supplied MQ Advanced container images=9.4.2.0-r2
IBM supplied MQ Advanced container images=9.4.2.1-r1
IBM supplied MQ Advanced container images=9.4.2.1-r2
IBM supplied MQ Advanced container images=9.4.3.0-r1

Remediation

Information

Issues mentioned by this security bulletin are addressed in - IBM MQ Operator v3.6.1 CD release that included IBM supplied MQ Advanced 9.4.3.0-r2 container image. IBM MQ Operator v3.2.14 SC2 release that included IBM supplied MQ Advanced 9.4.0.12-r1 container image. IBM MQ Container 9.4.3.0-r2 release. IBM strongly recommends applying the latest container images. IBM MQ Operator v3.6.1 CD release details: ibm-mq-operator v3.6.1 icr.io icr.io/cpopen/ibm-mq-operator@sha256:b1bbebeb361e9e59311684da233c7d5978ffe17a78feb03eeb2411df9a0f5d03 ibm-mqadvanced-server 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:5bd01da84348f4ffb8b96427b6b8a4c471e63153f13e912315c3e7c9b3fffa8d ibm-mqadvanced-server-integration 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:534c801a22338398bfb61ae443eeb6ba84152f0fad5538e212eefab1498336ed ibm-mqadvanced-server-dev 9.4.3.0-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:c2166a034f620d7479741342255968fe4076e8ce0bf45f1d67705ff1635146d5 IBM MQ Operator v3.2.14 SC2 release details: ibm-mq-operator v3.2.14 icr.io icr.io/cpopen/ibm-mq-operator@sha256:3979ba0bc28b6302f453633d3d238323c52679550760803d503ca51073c98cbf ibm-mqadvanced-server 9.4.0.12-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:222c1500565d08d6ab4dff9c7d550ce9e12909735e699882b79632ebe00dd61d ibm-mqadvanced-server-integration 9.4.0.12-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:762f4f5e04c682f9ce39d6e189999fb505e373a60791f5a91fc413e4a72be014 ibm-mqadvanced-server-dev 9.4.0.12-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:2d5fa97b1e7f4d3d27c9afa963876172dc634ac861e3a5c5cb1cbf1e81252e15 IBM MQ Container 9.4.3.0-r2 release details: ibm-mqadvanced-server 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:5bd01da84348f4ffb8b96427b6b8a4c471e63153f13e912315c3e7c9b3fffa8d ibm-mqadvanced-server-dev 9.4.3.0-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:c2166a034f620d7479741342255968fe4076e8ce0bf45f1d67705ff1635146d5

Event History

Jul 23, 2025
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Jul 24, 2025
CVE Published
via MITRE·02:52 PM
Data Sourced
via MITRE·02:52 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Nov 18, 57611
Event
via NVD·04:16 PM

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-36005?

CVE-2025-36005 has a medium severity rating due to potential sensitive information exposure through improper certificate validation.

2

How do I fix CVE-2025-36005?

To fix CVE-2025-36005, upgrade your IBM MQ Operator to a version that is not vulnerable, specifically versions above 2.0.29 for LTS and 3.1.2 or later for CD.

3

Which versions of IBM MQ are affected by CVE-2025-36005?

CVE-2025-36005 affects IBM MQ Operator LTS versions 2.0.0 to 2.0.29 and IBM MQ Operator CD versions 3.0.0, 3.0.1, and 3.1.0.

4

What potential impact does CVE-2025-36005 pose?

CVE-2025-36005 may allow a malicious user to access sensitive information from another TLS session that shares the same hostname and port.

5

Is CVE-2025-36005 specific to a certain IBM product?

Yes, CVE-2025-36005 specifically affects various versions of IBM MQ Operator, including LTS, CD, and SC2.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203