CVE-2021-38875: 
IBM WebSphere MQ vulnerability analysis and mitigation

IBM MQ versions 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD were found to be vulnerable to a denial of service attack. The vulnerability (CVE-2021-38875) was caused by an error in processing messages and was disclosed on November 18, 2021 (IBM Advisory).

The vulnerability has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue specifically affects the message processing code of IBM MQ, requiring authentication and proper authority to connect to the queue manager and put messages (NVD).

An authenticated attacker with authority to connect to the queue manager and put messages could execute a denial of service attack against the queue manager using a malformed message. The attack affects the availability of the system while having no impact on confidentiality or integrity (IBM Advisory).

IBM has released fixes through APAR IT36179. The recommended remediation includes: applying version 8.0 cumulative security update 'CSU01' for IBM MQ 8.0, FixPack 9.0.0.12 for version 9.0 LTS, FixPack 9.1.0.9 for version 9.1 LTS, FixPack 9.2.0.4 for version 9.2 LTS, and upgrading to IBM MQ 9.2.4 for versions 9.1 CD and 9.2 CD. No workarounds or alternative mitigations are available (IBM Advisory).