IBM MQ Operator information disclosure
Published Jul 24, 2025
6.5
MEDIUMCVSS 3.1
EPSS 0.17%
Description
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation.
Affected products
-
Affected
- ≥ 2.0.0 LTS, ≤ 2.0.29 LTS
- 3.0.0, 3.0.1, 3.1.0, 3.1.3, 3.4.0, 3.5.0, 3.5.1, 3.6.0 CD
- ≥ 3.2.0 SC2, ≤ 3.2.13 SC2
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| IBM | MQ Operator | unaffected | Affected
|
- ≥ 2.0.0 · ≤ 2.0.29
- ≥ 3.2.0 · ≤ 3.2.13
- ≥ 3.5.1 · ≤ 3.6.0
- 3.3.0
- 3.4.0
- 3.4.1
- 3.5.0
- 9.3.0.0
- 9.3.0.0
- 9.3.0.0
- 9.3.0.1
- 9.3.0.1
- 9.3.0.1
- 9.3.0.1
- 9.3.0.3
- 9.3.0.4
- 9.3.0.4
- 9.3.0.5
- 9.3.0.5
- 9.3.0.5
- 9.3.0.6
- 9.3.0.10
- 9.3.0.10
- 9.3.0.11
- 9.3.0.11
- 9.3.0.15
- 9.3.0.16
- 9.3.0.16
- 9.3.0.17
- 9.3.0.17
- 9.3.0.17
- 9.3.0.20
- 9.3.0.20
- 9.3.0.21
- 9.3.0.21
- 9.3.0.21
- 9.3.0.25
- 9.4.0.0
- 9.4.0.0
- 9.4.0.0
- 9.4.0.5
- 9.4.0.5
- 9.4.0.6
- 9.4.0.6
- 9.4.0.7
- 9.4.0.10
- 9.4.0.10
- 9.4.0.11
- 9.4.0.11
- 9.4.0.11
- 9.4.1.0
- 9.4.1.0
- 9.4.1.1
- 9.4.2.0
- 9.4.2.0
- 9.4.2.1
- 9.4.2.1
- 9.4.3.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Issues mentioned by this security bulletin are addressed in -
IBM MQ Operator v3.6.1 CD release that included IBM supplied MQ Advanced 9.4.3.0-r2 container image. IBM MQ Operator v3.2.14 SC2 release that included IBM supplied MQ Advanced 9.4.0.12-r1 container image. IBM MQ Container 9.4.3.0-r2 release. IBM strongly recommends applying the latest container images.
IBM MQ Operator v3.6.1 CD release details: ibm-mq-operator v3.6.1 icr.io icr.io/cpopen/ibm-mq-operator@sha256:b1bbebeb361e9e59311684da233c7d5978ffe17a78feb03eeb2411df9a0f5d03 ibm-mqadvanced-server 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:5bd01da84348f4ffb8b96427b6b8a4c471e63153f13e912315c3e7c9b3fffa8d ibm-mqadvanced-server-integration 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:534c801a22338398bfb61ae443eeb6ba84152f0fad5538e212eefab1498336ed ibm-mqadvanced-server-dev 9.4.3.0-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:c2166a034f620d7479741342255968fe4076e8ce0bf45f1d67705ff1635146d5
IBM MQ Operator v3.2.14 SC2 release details: ibm-mq-operator v3.2.14 icr.io icr.io/cpopen/ibm-mq-operator@sha256:3979ba0bc28b6302f453633d3d238323c52679550760803d503ca51073c98cbf ibm-mqadvanced-server 9.4.0.12-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:222c1500565d08d6ab4dff9c7d550ce9e12909735e699882b79632ebe00dd61d ibm-mqadvanced-server-integration 9.4.0.12-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:762f4f5e04c682f9ce39d6e189999fb505e373a60791f5a91fc413e4a72be014 ibm-mqadvanced-server-dev 9.4.0.12-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:2d5fa97b1e7f4d3d27c9afa963876172dc634ac861e3a5c5cb1cbf1e81252e15
IBM MQ Container 9.4.3.0-r2 release details: ibm-mqadvanced-server 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:5bd01da84348f4ffb8b96427b6b8a4c471e63153f13e912315c3e7c9b3fffa8d ibm-mqadvanced-server-dev 9.4.3.0-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:c2166a034f620d7479741342255968fe4076e8ce0bf45f1d67705ff1635146d5
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22522 Advisory
- https://www.ibm.com/support/pages/node/7240431 vendor-advisorypatchVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22522 | Advisory | |
| https://www.ibm.com/support/pages/node/7240431 | vendor-advisorypatchVendor Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data