Security Bulletin: IBM QRadar SIEM is vulnerable to possible information disclosure [CVE-2023-22875]

Workarounds and Mitigations

QRadar managed hosts are not intended to be accessed directly via SSH. All management of managed hosts should be done via the console. Customers in environments where access to managed hosts is permitted by users other than QRadar system administrators, such as those with changes made to permit direct SSH access to managed hosts, or who otherwise have concerns about the keys on the managed hosts can take the following steps to mitigate the risk.

Remove the key from all hosts in the deployment other than the console by executing the following command from the QRadar console to remove the key from all managed hosts.

/opt/qradar/support/all_servers.sh -k "> /etc/httpd/conf/certs/cert.key ; chmod 400 /etc/httpd/conf/certs/cert.key"

To validate that the fix has been applied, inspect /etc/httpd/conf/certs/cert.key and confirm the size of the cert.key file is zero bytes. This can be done on all managed hosts with the following command

/opt/qradar/support/all_servers.sh -k ls -lhtr /etc/httpd/conf/certs/ 

Sample Output:

192.x.x.x -> managedhost.example.com
Appliance Type: 1400    Product Version: 2021.6.3.20220829221022
 17:49:37 up 25 days, 12:27,  0 users,  load average: 0.83, 0.85, 0.64
------------------------------------------------------------------------
total 4.0K
-rw-r--r-- 1 root root 1.9K Aug  6 12:38 cert.cert
-r-------- 1 root root    0 Jan 13 17:43 cert.key 

Note: The following actions will cause the key to be redistributed to managed hosts, which will require an administrator to execute the above command again to delete the newly redistributed keys. The planned fixes will eliminate this redistribution.

1. Adding a new managed host
2. Applying a Fix or Upgrade Pack
3. Installing a new webserver TLS certificate using install-ssl-cert.sh