Security Bulletin: Vulnerability in sqlite affects IBM VM Recovery Manager HA GUI

Summary

There is vulnerability in sqlite opensource package which affects IBM VM Recovery Manager HA and DR GUI. No impacts to VM Recovery Manager HA and DR cli.

Vulnerability Details

CVEID:CVE-2022-21227
**DESCRIPTION:**Node.js sqlite3 module is vulnerable to a denial of service, caused by improper input validation by the toString function. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause the V8 engine to crash, and results in a denial of service condition.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225552 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

VM Recovery Manager HA Version 1.6.0.0

Apply the GUI filesets available at location for 1.6.0.0 release

https://aix.software.ibm.com/aix/efixes/security/VMRMDR/VMRM1.6/PVR0355…

Command to install filesets:

installp -a -F -Y -d . ksys.ui.server ksys.ui.agent ksys.ui.common

Workarounds and Mitigations

None