Skip to content
CVE PROGRAM SOURCE RECORD4.7 Medium

CVE-2025-36041

IBM MQ improper certificate validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose sensitive information or allow the attacker to perform unauthorized actions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM MQ Operator

Default version status: unaffected

  • 2.0.0 LTS to ≤ 2.0.29 LTSaffected
  • 3.0.0, 3.0.1, 3.1.0, 3.1.3, 3.4.0, 3.5.0, 3.5.1, 3.5.3 CDaffected
  • 3.2.0 SC2 to ≤ 3.2.10 SC2affected

References