CVE-2021-39034: 
IBM WebSphere MQ vulnerability analysis and mitigation

IBM MQ 9.1 LTS was identified with a vulnerability (CVE-2021-39034) that affects the queue manager channel process on Solaris platforms. The vulnerability was disclosed with a CVSS v3.1 base score of 7.5 (HIGH) according to NVD, while IBM Corporation assessed it with a CVSS v3.0 base score of 5.3 (MEDIUM) (NVD, IBM Advisory).

The vulnerability exists within the channel process of IBM MQ and affects versions from 9.1.0.0 up to and including 9.1.0.9. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high availability impact (NVD).

The vulnerability can lead to a denial of service attack affecting the availability of the IBM MQ service. The CVSS metrics indicate that while there is no impact on confidentiality or integrity, the vulnerability can have a high impact on system availability (IBM Advisory).

The vulnerability can be exploited over the network with low attack complexity and requires no special privileges or user interaction, making it relatively straightforward to exploit (NVD).

IBM has addressed this vulnerability through APAR IT37896. Users should apply iFix 9.1.0.10-IBM-MQ-SolarisSparc64-LAIT37896 to affected systems. No alternative workarounds or mitigations are available (IBM Advisory).